# OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and Crypto Apps (Cyble CRIL)

> OverlayPhantom is a previously undocumented Android banking trojan disclosed by Cyble Research and Intelligence Labs (CRIL) in May 2026 and active in the wild since May 2025. It is distributed via malicious URLs impersonating ID Austria and TikTok, abuses Android Accessibility Services to drive overlay phishing, JPEG screen streaming, and remote gesture automation, and targets 180+ banking, financial, and cryptocurrency applications across 10 Western nations. Its single C2 (199.217.99.122) uses dedicated TCP ports 9090/9091/9092 for streaming, command, and status channels respectively.

- **Published:** 2026-05-27T00:00:00Z
- **Last reviewed:** 2026-05-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0598
- **ID:** TL-2026-0598
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OverlayPhantom is a financially motivated Android banking trojan first observed in early May 2025 and publicly disclosed by Cyble Research and Intelligence Labs (CRIL) on 27 May 2026. The malware family is characterized by Cyble as 'previously undocumented' with no published code or infrastructure overlap with established Android banking trojan families such as Cerberus, Hydra, ERMAC, Anatsa, BrasDex, Sharkbot, Hook, or GodFather. The threat actor is unattributed but described as having both the technical capability and strategic intent to conduct large-scale financial fraud across Western markets.

Distribution and Two-Stage Infection Chain. The campaign is delivered through phishing URLs serving counterfeit application installers. The first observed sample impersonated 'ID Austria' — the official Austrian government digital identity application — and was served from hxxps://bitlrewards-app[.]com/api/download/IDAustria. A second wave impersonated TikTok and targeted Spanish users. The dropper APK launches a convincing fake Google Play update screen and walks the victim through an interactive step-by-step tutorial that coerces enabling of the Accessibility Service. After installation, the OverlayPhantom core payload masquerades as 'Google Play Services', hides or renames its icon, and immediately solicits Accessibility permissions. Once granted, the payload establishes a socket-based session with its C2 server at 199.217.99.122.

C2 Architecture. OverlayPhantom uses three dedicated non-standard TCP ports on a single hardcoded C2 IP. Port 9090 carries JPEG-encoded screen streams produced via the Android MediaProjection API and a VirtualDisplay named jpeg-stream, with frames resized to 540px width and dynamic height. Port 9091 carries the bidirectional command channel — operator commands inbound, status and harvested data outbound. Port 9092 is reserved for device status and reporting. Before streaming begins, the malware registers a bot/session identifier derived from its configured Bot ID and the device ID. Streaming is resilient: on socket failure the malware sleeps roughly two seconds and retries, tearing down and re-establishing the socket; repeated failures disable the streaming flag rather than crashing.

Command Set and Capabilities. The malware exposes a 30-command surface. Gesture automation primitives — tap, doubleTap, longPress, swipe, draw — drive arbitrary UI manipulation via Accessibility, enabling on-device transaction authorization. UI-control commands openRecents, switchScreen, volumeUp, volumeDown, power, brightSettings, back, and home navigate the device. The buf command sets attacker-supplied text into the clipboard; notif renders a fake notification banner using the target app's icon and name. switchOffScreen, blankScreen, and blankScreenRm lock the device or display a black overlay to mask on-device fraudulent activity from the victim. pinj displays a credential-collection overlay window for PINs, passwords, or pattern locks. startStreamJpeg/stopStreamJpeg control screen streaming; startStreamACNode/stopStreamACNode exfiltrate the Accessibility UI tree. target receives the active target package list; resendInj and rmResend manage the per-target injection ruleset. ping/Pong maintain the keepalive. register binds a fresh device to a Bot ID. Counterfeit HTML phishing pages are embedded in APK resources and rendered as overlays through WebView when the foreground app matches the hardcoded target list.

Targeting. The malware ships a hardcoded list of more than 180 banking, financial-services, and cryptocurrency applications and is geofenced to 10 countries: United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom. Cyble did not publish the per-package target list in prose form; the full inventory is shown only in Figure 5 of the report.

Evasion and Persistence. OverlayPhantom hides its launcher icon (T1628.001), masquerades as Google Play Services (T1655.001), and uses obfuscated strings (T1406). Persistence is anchored on continuous Accessibility-driven foreground monitoring and a broadcast receiver registered for screen capture (T1624.001). The two-stage dropper-plus-payload delivery limits analytic surface on the initial install.

Defenders should treat 199.217.99.122 and bitlrewards-app[.]com as high-confidence indicators of OverlayPhantom activity, block the three C2 ports at egress, hunt for Accessibility-enable events tied to apps masquerading as Google Play Services, and monitor MediaProjection start events from non-Google-signed packages.

## MITRE ATT&CK

- T1660 Phishing
- T1476 Deliver Malicious App via Other Means
- T1575 Native API
- T1624.001 Event Triggered Execution: Broadcast Receivers
- T1541 Foreground Persistence
- T1628.001 Hide Artifacts: Suppress Application Icon
- T1406 Obfuscated Files or Information
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1516 Input Injection
- T1453 Abuse Accessibility Features
- T1417.002 Input Capture: GUI Input Capture
- T1414 Clipboard Data
- T1418 Software Discovery
- T1426 System Information Discovery
- T1513 Screen Capture
- T1533 Data from Local System
- T1437 Application Layer Protocol
- T1509 Non-Standard Port
- T1644 Out of Band Data
- T1646 Exfiltration Over C2 Channel
- T1640 Account Access Removal

## Sources

- [OverlayPhantom: The Android Banking Trojan Hiding in Plain Sight](https://cyble.com/blog/overlayphantom-android-banking-trojan/)
- [Cyble Research and Intelligence Labs Blog Feed](https://cyble.com/feed/)
- [MITRE ATT&CK for Mobile — T1660 Phishing](https://attack.mitre.org/techniques/T1660/)
- [MITRE ATT&CK for Mobile — T1655.001 Masquerading: Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1655/001/)
- [MITRE ATT&CK for Mobile — T1628.001 Hide Artifacts: Suppress Application Icon](https://attack.mitre.org/techniques/T1628/001/)
- [MITRE ATT&CK for Mobile — T1453 Abuse Accessibility Features](https://attack.mitre.org/techniques/T1453/)
- [MITRE ATT&CK for Mobile — T1513 Screen Capture](https://attack.mitre.org/techniques/T1513/)
- [Android Developers — MediaProjection API](https://developer.android.com/reference/android/media/projection/MediaProjection)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0598