Security researchers at Zimperium’s zLabs report a new Android banking trojan, Rokarolla, designed to target 217 banking and cryptocurrency applications. The malware is associated with command-and-control infrastructure that Zimperium says is also behind the “Rokarolla” name. According to the researchers, Rokarolla contains 137 remote commands that enable an operator to take extensive control of an infected device.
The reported capabilities include extracting the phone’s lock-screen PINs, and reading and sending SMS messages, which can include verification codes. Researchers also state that the malware can manipulate the clipboard to redirect cryptocurrency payment details, potentially steering funds to an attacker-controlled destination. In addition to these theft and redirection functions, the malware can disable Google Play on the infected phone, which can affect the user’s ability to install security tools or updates.
Across the outlets, the common focus is on the trojan’s broad target list (217 banking and crypto apps), the size of its remote command set (137), and the primary mechanisms described for credential and funds theft.
