OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and Crypto Apps (Cyble CRIL)

Key facts for OverlayPhantom Android banking trojan

Detection coverage for OverlayPhantom Android banking trojan

As of 2026-05-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0598 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: OverlayPhantom Masquerade Payload & jpeg-stream Artifact (Post-Exploitation)

Detects post-installation OverlayPhantom artifacts: a binary/APK masquerading as 'GooglePlayServices' dropped in user-writable directories, the HKCU Run persistence entry 'GooglePlayServicesUpdate', or the MediaProjection-derived 'jpeg-stream' VirtualDisplay artifact pattern (jpeg-stream-frame-NNN.jpg). Catches the masquerading-as-Google-Play-Services defense-evasion stage and the screen-streaming setup that immediately follows Accessibility-grant.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1655.001, T1628.001, T1513, T1547.001
• Data sources: sysmon, edr_file_events, edr_process_events, edr_registry_events, windows_security
• Severity: high
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11 OR EventCode=13)) earliest=-24h
| eval artifact=coalesce(TargetFilename, Image, TargetObject)
| eval is_masquerade=if(match(artifact, "(?i)\\\\GooglePlayServices(\\.exe|\\.apk|\\.apk\\.sim)") OR match(artifact, "(?i)/GooglePlayServices\\.(exe|apk|apk\\.sim)"), 1, 0)
| eval is_jpegstream=if(match(artifact, "(?i)jpeg-stream(-frame-)?") OR match(coalesce(Details, CommandLine, ""), "(?i)VirtualDisplay.*jpeg-stream"), 1, 0)
| eval is_runkey=if(EventCode=13 AND match(TargetObject, "(?i)\\\\CurrentVersion\\\\Run\\\\GooglePlayServicesUpdate"), 1, 0)
| where (is_masquerade=1 OR is_jpegstream=1 OR is_runkey=1)
| stats count, values(artifact) as artifacts, values(Image) as images, values(ParentImage) as parents, values(User) as users, max(is_masquerade) as masquerade, max(is_jpegstream) as jpeg_stream, max(is_runkey) as run_key by host, ProcessGuid
| where count > 0
| sort - count
| table host, User, parents, images, artifacts, masquerade, jpeg_stream, run_key, count

Microsoft KQL

let suspicious_names = dynamic(["GooglePlayServices.exe", "GooglePlayServices.apk", "GooglePlayServices.apk.sim"]);
let jpeg_artifacts = dynamic(["jpeg-stream", "jpeg-stream-frame-"]);
union isfuzzy=true
  (DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName in~ (suspicious_names) or FileName has_any (jpeg_artifacts)
    | project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256, ActionType
    | extend Signal = "OverlayPhantom masquerade or jpeg-stream artifact"),
  (DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ (suspicious_names) or ProcessCommandLine has_any (suspicious_names) or ProcessCommandLine has "jpeg-stream"
    | where InitiatingProcessFileName !in~ ("MsMpEng.exe", "SenseIR.exe")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
    | extend Signal = "OverlayPhantom masquerade execution"),
  (DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey has @"\CurrentVersion\Run" and (RegistryValueName has "GooglePlayServicesUpdate" or RegistryValueData has "GooglePlayServices")
    | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
    | extend Signal = "OverlayPhantom HKCU Run persistence")
| order by Timestamp desc

Sigma

title: OverlayPhantom GooglePlayServices Masquerade and jpeg-stream Artifact
id: 7b3a4c01-0598-4f1f-91a4-0f1d9b2c5a02
status: experimental
description: Detects OverlayPhantom post-installation artifacts — a binary or APK masquerading as Google Play Services in user-writable directories, the HKCU Run persistence value 'GooglePlayServicesUpdate', or filesystem evidence of the MediaProjection 'jpeg-stream' VirtualDisplay used for screen exfiltration.
references:
    - https://cyble.com/blog/overlayphantom-android-banking-trojan/
    - https://attack.mitre.org/techniques/T1655/001/
    - https://attack.mitre.org/techniques/T1513/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-05-27
tags:
    - attack.defense_evasion
    - attack.t1655.001
    - attack.t1628.001
    - attack.collection
    - attack.t1513
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    category: file_event
detection:
    selection_masquerade:
        TargetFilename|endswith:
            - '\GooglePlayServices.exe'
            - '\GooglePlayServices.apk'
            - '\GooglePlayServices.apk.sim'
    selection_jpegstream:
        TargetFilename|contains:
            - 'jpeg-stream-frame-'
            - '\jpeg-stream'
    selection_runkey:
        TargetObject|contains: '\CurrentVersion\Run\GooglePlayServicesUpdate'
    filter_legit:
        Image|startswith:
            - 'C:\Program Files\Google\'
            - 'C:\Program Files (x86)\Google\'
    condition: (selection_masquerade or selection_jpegstream or selection_runkey) and not filter_legit
fields:
    - TargetFilename
    - Image
    - User
    - TargetObject
falsepositives:
    - Authorised mobile-malware analysts producing simulated artifacts in lab
    - Android emulator (Android Studio, BlueStacks) writing legitimate Google Play Services artifacts under a developer account
level: high

Known false positives:

• Authorized malware analysts running OverlayPhantom lab simulations producing GooglePlayServices.* artifacts under controlled conditions
• Android emulator dev environments (Android Studio, Genymotion) creating legitimate Google Play Services build outputs in developer-owned paths

Tuning notes: Exclude developer-owned paths and signed Google Android SDK build outputs. Escalate to critical when masquerade artifact, jpeg-stream output, AND Run-key persistence appear on the same host within a short window — that combination is unambiguous OverlayPhantom-style post-exploitation activity.

• 🔒 OverlayPhantom Initial-Access APK Drop from [indicator] (Exploitation) · unlock with TL Creds
• 🔒 OverlayPhantom Accessibility-Driven Masquerade & MediaProjection VirtualDisplay (Post-Exploitation) · unlock with TL Creds
• 🔒 OverlayPhantom Three-Channel C2 in Defender / Sentinel (C2 & Exfiltration) · unlock with TL Creds
• 🔒 OverlayPhantom Distribution URL & Domain (Sigma — Exploitation) · unlock with TL Creds
• 🔒 OverlayPhantom Accessibility-Abuse Masquerade Artifact (Sigma — Post-Exploitation) · unlock with TL Creds
• 🔒 OverlayPhantom Triple-Port Socket C2 Fingerprint (Sigma — C2 & Lateral Movement) · unlock with TL Creds
• 🔒 OverlayPhantom Dropper Distribution — [indicator] APK Download (Exploitation) · unlock with TL Creds
• 🔒 OverlayPhantom Triple-Port C2 Beacon to [indicator] (Command and Control) · unlock with TL Creds

Indicators of compromise for OverlayPhantom Android banking trojan

As of 2026-05-27, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-0598.

Sample indicators (3 of 18)

• IP address: 199.217.99[.]122
• Domain: bitlrewards-app[.]com
• File hash: 9ef37376bfaa18e193cc72218924ad8ebf56d2667d348f0eae5ae6ec45ab8775

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

How OverlayPhantom Android banking trojan works

Its single C2 (199.217.99.122) uses dedicated TCP ports 9090/9091/9092 for streaming, command, and status channels respectively.

OverlayPhantom is a financially motivated Android banking trojan first observed in early May 2025 and publicly disclosed by Cyble Research and Intelligence Labs (CRIL) on 27 May 2026. The malware family is characterized by Cyble as 'previously undocumented' with no published code or infrastructure overlap with established Android banking trojan families such as Cerberus, Hydra, ERMAC, Anatsa, BrasDex, Sharkbot, Hook, or GodFather. The threat actor is unattributed but described as having both the technical capability and strategic intent to conduct large-scale financial fraud across Western markets.

Distribution and Two-Stage Infection Chain. The campaign is delivered through phishing URLs serving counterfeit application installers. The first observed sample impersonated 'ID Austria' — the official Austrian government digital identity application — and was served from hxxps://bitlrewards-app[.]com/api/download/IDAustria. A second wave impersonated TikTok and targeted Spanish users. The dropper APK launches a convincing fake Google Play update screen and walks the victim through an interactive step-by-step tutorial that coerces enabling of the Accessibility Service. After installation, the OverlayPhantom core payload masquerades as 'Google Play Services', hides or renames its icon, and immediately solicits Accessibility permissions. Once granted, the payload establishes a socket-based session with its C2 server at 199.217.99.122.

C2 Architecture. OverlayPhantom uses three dedicated non-standard TCP ports on a single hardcoded C2 IP. Port 9090 carries JPEG-encoded screen streams produced via the Android MediaProjection API and a VirtualDisplay named jpeg-stream, with frames resized to 540px width and dynamic height. Port 9091 carries the bidirectional command channel — operator commands inbound, status and harvested data outbound. Port 9092 is reserved for device status and reporting. Before streaming begins, the malware registers a bot/session identifier derived from its configured Bot ID and the device ID. Streaming is resilient: on socket failure the malware sleeps roughly two seconds and retries, tearing down and re-establishing the socket; repeated failures disable the streaming flag rather than crashing.

Command Set and Capabilities. The malware exposes a 30-command surface. Gesture automation primitives — tap, doubleTap, longPress, swipe, draw — drive arbitrary UI manipulation via Accessibility, enabling on-device transaction authorization. UI-control commands openRecents, switchScreen, volumeUp, volumeDown, power, brightSettings, back, and home navigate the device. The buf command sets attacker-supplied text into the clipboard; notif renders a fake notification banner using the target app's icon and name. switchOffScreen, blankScreen, and blankScreenRm lock the device or display a black overlay to mask on-device fraudulent activity from the victim. pinj displays a credential-collection overlay window for PINs, passwords, or pattern locks. startStreamJpeg/stopStreamJpeg control screen streaming; startStreamACNode/stopStreamACNode exfiltrate the Accessibility UI tree. target receives the active target package list; resendInj and rmResend manage the per-target injection ruleset. ping/Pong maintain the keepalive. register binds a fresh device to a Bot ID. Counterfeit HTML phishing pages are embedded in APK resources and rendered as overlays through WebView when the foreground app matches the hardcoded target list.

Targeting. The malware ships a hardcoded list of more than 180 banking, financial-services, and cryptocurrency applications and is geofenced to 10 countries: United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom. Cyble did not publish the per-package target list in prose form; the full inventory is shown only in Figure 5 of the report.

Evasion and Persistence. OverlayPhantom hides its launcher icon (T1628.001), masquerades as Google Play Services (T1655.001), and uses obfuscated strings (T1406). Persistence is anchored on continuous Accessibility-driven foreground monitoring and a broadcast receiver registered for screen capture (T1624.001). The two-stage dropper-plus-payload delivery limits analytic surface on the initial install.

Defenders should treat 199.217.99.122 and bitlrewards-app[.]com as high-confidence indicators of OverlayPhantom activity, block the three C2 ports at egress, hunt for Accessibility-enable events tied to apps masquerading as Google Play Services, and monitor MediaProjection start events from non-Google-signed packages.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406 Obfuscated Files or Information; T1516 Input Injection; T1628.001 Hide Artifacts: Suppress Application Icon; T1655.001 Masquerading: Match Legitimate Name or Location

Credential Access

T1414 Clipboard Data; T1417.002 Input Capture: GUI Input Capture; T1453 Abuse Accessibility Features

Discovery

T1418 Software Discovery; T1426 System Information Discovery

Command and Control

T1437 Application Layer Protocol; T1509 Non-Standard Port; T1644 Out of Band Data

Initial Access

T1476 Deliver Malicious App via Other Means; T1660 Phishing

Collection

T1513 Screen Capture; T1533 Data from Local System

Persistence

T1541 Foreground Persistence; T1624.001 Event Triggered Execution: Broadcast Receivers

Execution

T1575 Native API

Impact

T1640 Account Access Removal

Exfiltration

T1646 Exfiltration Over C2 Channel

Remediation for OverlayPhantom Android banking trojan

Patches

• No vendor patch — this is malware, not a vulnerability. Ensure devices run Android 13+ with Google Play Protect enabled and current Google Play Services. Android 13 restricted Accessibility access for sideloaded apps; Android 14 hardened the restricted-settings flow — keep devices upgraded.

Immediate actions

• Block C2 IP 199.217.99.122 at perimeter and egress firewalls — drop traffic on TCP/9090, TCP/9091, and TCP/9092
• Sinkhole or block the distribution domain bitlrewards-app[.]com at DNS and web-filtering layers
• Blocklist the three OverlayPhantom SHA256 hashes in mobile EDR, MTD, and EMM/MDM solutions
• Push an emergency advisory to employees and customers warning against installing ID Austria or TikTok APKs delivered via SMS, email, or social-media links — direct users only to official Google Play Store listings
• For Android fleet devices, enforce Google Play Protect and disallow installation from unknown sources via EMM policy
• Hunt EDR/MTD telemetry for Accessibility-enable events on packages masquerading as 'Google Play Services' or signed by non-Google certificates

Workarounds

• Disable installation from unknown sources globally via EMM/MDM
• Audit all apps holding Accessibility privileges on managed devices and revoke from any unrecognized package
• If compromise suspected: revoke Accessibility from the offending app, uninstall via Settings > Apps (some variants block uninstall via gesture interception — boot into Safe Mode if needed), rotate all banking, brokerage, and crypto credentials, contact financial institutions, and consider factory reset

Longer-term hardening

• Deploy mobile threat defense (MTD) or EDR for Android with detection for Accessibility Service abuse, MediaProjection misuse, and overlay window creation by non-system apps
• Enforce Play Integrity API attestation in critical banking, brokerage, and crypto apps to detect rooted, rooted-bypass, or instrumented devices
• Adopt FIDO2/passkey authentication for banking and crypto apps to neutralize overlay credential-theft, SMS OTP interception, and on-device transaction-approval automation
• For banking and fintech operators, implement transaction-level behavioral analytics (typing cadence, touch dynamics, navigation patterns) to detect Accessibility-driven gesture automation
• Restrict installation of apps requesting BIND_ACCESSIBILITY_SERVICE permission from sources outside the Google Play Store via EMM
• Educate users on recognising fake 'Google Play update' prompts and Accessibility setup tutorials

Affected and fixed versions

• Google — Android
  Vulnerable versions: Android versions where users can grant Accessibility Service permission to sideloaded applications
• Multiple — Banking, financial services, and cryptocurrency applications (180+ apps)
  Vulnerable versions: Banking and crypto apps relying on knowledge-factor authentication (PIN, password, pattern, SMS OTP) without strong on-device anti-overlay or attestation controls

Timeline of OverlayPhantom Android banking trojan

• 2025-05-01 locked-ioc-17 first observed active in the wild per Cyble CRIL retrospective analysis — earliest known samples date to early May 2025.
• 2025-05-15 First documented distribution wave impersonates the official Austrian government digital identity application 'ID Austria', served from locked-ioc-10.
• 2025-08-01 Second observed campaign wave impersonates TikTok and shifts geographic focus to Spanish users.
• 2025-11-01 Hardcoded target list expands to encompass more than 180 banking, financial-services, and cryptocurrency applications across 10 Western nations.
• 2026-05-27 Threadlinqs Intelligence ingests locked-ioc-17 as TL-2026-0598; Researcher publishes D1 record, Detector authors SPL/KQL/Sigma rules, Pentester authors Atomic-style overlay/Accessibility simulations.
• 2026-05-27 Cyble Research and Intelligence Labs (CRIL) publicly discloses locked-ioc-17 in 'locked-ioc-17: The Android Banking Trojan Hiding in Plain Sight', publishing C2 IP, three TCP ports, three SHA256 hashes, the 30-command set, and full MITRE ATT&CK for Mobile mapping.
• 2026-05-29 As of 2026-05-29, locked-ioc-17 remains an active Android banking trojan: Cyble CRIL disclosed it only on 2026-05-27, it has run in the wild since May 2025 targeting 180+ banking/crypto apps, and no takedown, sinkhole, arrest, or attribution has occurred. Its C2 (locked-ioc-16) is reported operational and researchers warn the campaign may keep expanding.

Sources cited for OverlayPhantom Android banking trojan

• Cyble Research and Intelligence Labs Blog Feed cyble.com · Vendor report · 2026-05-27
• MITRE ATT&CK for Mobile — T1660 Phishing MITRE · Research · 2026-05-27
• MITRE ATT&CK for Mobile — T1655.001 Masquerading: Match Legitimate Name or Location MITRE · Research · 2026-05-27
• MITRE ATT&CK for Mobile — T1628.001 Hide Artifacts: Suppress Application Icon MITRE · Research · 2026-05-27
• MITRE ATT&CK for Mobile — T1453 Abuse Accessibility Features MITRE · Research · 2026-05-27
• MITRE ATT&CK for Mobile — T1513 Screen Capture MITRE · Research · 2026-05-27
• Android Developers — MediaProjection API developer.android.com · Vendor report · 2026-05-27
• OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight cyble.com · Blog · 2026-05-27

Threats related to OverlayPhantom Android banking trojan

• TrickMo.C Android Banking Trojan Adopts TON Blockchain ADNL for Covert C2 Targeting Banking and Crypto Users in France, Italy, and Austria
• Copybara Android RAT Delivered via Fake N26 Support Vishing Calls
• Anatsa (TeaBot) Banking Trojan Distributed via Fake "File Horizon Explorer" Document Reader App on Google Play
• Octagon / OctagonPanel "Ward" Android RAT Impersonates Bahrain's "BH Alert" Civil Defense App to Steal Credentials, SMS/OTPs, and Banking Data
• ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries

Related coverage of this activity

• Glitch SPY RAT
• MagicAd Android adware trojan
• Rokarolla Android banking trojan
• BTMOB MaaS reseller ecosystem
• OctagonPanel BH Alert RAT

Previous and next in malware

• GPU-Targeted Cryptojacking Campaign — SEO + AI Chatbot Poisoning Delivers ScreenConnect & SimpleRunPE Process Hollowing into .NET Utilities (Microsoft Defender Experts) Previous report
• BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services Abuse Next report