Android Malware
What is Android Malware?
Android MalwareMalicious software that targets the Android operating system, typically distributed through sideloaded APKs, dropper apps on Google Play, or compromised third-party stores.
Android malware ranges from advertising fraud and SMS premium-rate trojans to banking trojans, spyware, and remote-access tools. Well-documented families include Joker (premium-SMS fraud, repeatedly found on Google Play), Anubis and Cerberus (banking trojans abusing accessibility services to overlay phishing screens and steal SMS-based OTPs), BRATA (banking RAT that can factory-reset the device), and SharkBot (banking trojan using Automated Transfer Systems to initiate fraudulent transfers).
Two campaigns illustrate the scale. FluBot, a smishing worm first seen in December 2020, spread by texting fake package-delivery and voicemail links that installed an APK, then harvested contacts to text itself onward; a 2022 operation across 11 countries coordinated by Europol's EC3 dismantled its infrastructure. GriftHorse, documented by Zimperium zLabs in 2021, used roughly 200 innocuous-looking apps to subscribe an estimated 10 million-plus users across 70+ countries to premium services costing around EUR 30 a month.
The dominant delivery pattern today is a benign "dropper" that clears Google Play review, then side-loads the real payload and requests the Accessibility Service to read the screen, autofill fraudulent transfers, and dismiss its own uninstall dialogs. Families such as Anatsa (TeaBot) and Xenomorph refined this route.
Defences: stay on Google Play with Play Protect real-time scanning, use Android 13+ Restricted Settings (which block side-loaded apps from Accessibility and Notification-Listener access), keep the OS patched, and enforce EMM/MDM with Play Integrity attestation on enterprise devices.
flowchart TD
A[Dropper app passes<br/>Google Play review] --> B[User installs<br/>from Play or phishing SMS]
B --> C[App side-loads<br/>real payload]
C --> D{User grants<br/>Accessibility Service?}
D -->|No| E[Malware nags with<br/>fake system prompts]
E --> D
D -->|Yes| F[Read screen, inject<br/>overlays, autofill]
F --> G[Steal OTP / credentials<br/>Automated Transfer System]
G --> H[Fraudulent transfer<br/>or premium subscription]● Examples
- 01
Joker subscribes the victim to premium services after passing Google Play review through staged payloads.
- 02
BRATA wipes the device with a factory reset once the attacker has finished the fraudulent transaction.
● Frequently asked questions
What is Android Malware?
Malicious software that targets the Android operating system, typically distributed through sideloaded APKs, dropper apps on Google Play, or compromised third-party stores. It belongs to the Mobile Security category of cybersecurity.
What does Android Malware mean?
Malicious software that targets the Android operating system, typically distributed through sideloaded APKs, dropper apps on Google Play, or compromised third-party stores.
How do you defend against Android Malware?
Defences for Android Malware typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for Android Malware?
Common alternative names include: Android trojan, Malicious Android app.