[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuuUhckzKwJORCjnV1nAx1V70ZJXva4a3C_H62srzcuQ":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"943a312e-326c-4edc-92d2-5c011c4536b4","New Rokarolla Android Trojan Found Targeting 217 Crypto and Banking Apps","new-rokarolla-android-trojan-found-targeting-217-crypto-and-banking-apps-659493","Zimperium researchers discover a new mobile Trojan that hijacks clipboards, blocks bank calls, and takes complete control of Android devices.","A new Android banking trojan named Rokarolla has been discovered by Zimperium researchers. This malware is capable of hijacking clipboards, blocking bank calls, and taking complete control of infected devices. It targets 217 cryptocurrency and banking applications by using fake screen overlays and requesting Accessibility Services permissions.","New Rokarolla Android Trojan targets 217 crypto and banking apps with clipboard hijacking and device control.","https:\u002F\u002Fhackread.com\u002Frokarolla-android-trojan-crypto-and-banking-apps\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Frokarolla-android-trojan-crypto-and-banking-apps.png","2026-06-16T13:00:00+00:00","2026-06-16T14:00:05.273202+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"TikTok","product",{"name":21,"type":19},"Google Chrome",{"name":23,"type":19},"Google Play Protect",{"name":25,"type":26},"Zimperium","vendor",{"name":28,"type":29},"Rokarolla","threat_actor",{"name":31,"type":26},"Cequence Security","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"domain","infocontablidades.it.com","Malicious website used in the initial infection vector.",[25,31,18],{"controls":52,"vendors":126},[53,74,100],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[58,66],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":75,"name":76,"problem":77,"products":78},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[79,87,92],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":88,"product_name":89,"url":90,"description":91},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":101,"name":102,"problem":103,"products":104},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":122,"product_name":123,"url":124,"description":125},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":142},"rokarolla-android-trojan-hijacks-crypto-and-banking-apps-via-accessibility-abuse","Rokarolla Android Trojan Hijacks Crypto and Banking Apps via Accessibility Abuse","The Rokarolla Android trojan exploits users' willingness to grant broad Accessibility Services permissions, enabling full device takeover across 217 financial and crypto applications. By using fake screen overlays (overlay attacks), it silently captures credentials and intercepts clipboard data — including cryptocurrency wallet addresses — without the user's knowledge. This matters because mobile banking trojans that abuse legitimate OS features are extremely difficult to detect with standard antivirus tools. The root issue lies in a lack of user awareness about the risks of granting elevated permissions to unverified apps, combined with insufficient mobile device security controls.",[132,133,134,135,136,137,138,139,140,141],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices","NIST AC-6: Least Privilege","NIST SI-3: Malicious Code Protection","NIST SP 800-163: Vetting the Security of Mobile Applications","GDPR Article 32: Security of Processing (for apps handling personal\u002Ffinancial data)","OWASP Mobile Top 10: M1 - Improper Platform Usage","OWASP Mobile Top 10: M6 - Insecure Authorization",{}]