Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands

Rokarolla Android Banking Trojan Targets 217 Banking and (TL-2026-0826), also tracked as Rokarolla, is a high-severity malware campaign, first published 2026-06-16. It has no confirmed attribution, affects Google Android (devices with sideloading enabled / Accessibility, maps to 23 MITRE ATT&CK techniques (T1407, T1414, T1417), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-0826

Threat ID
TL-2026-0826
Also known as
Rokarolla
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-16
Last reviewed
2026-06-16
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
financial, cryptocurrency, banking, consumer
Target regions
Global
Detection rules
9
Indicators of compromise
33

Malware and tooling in Rokarolla Android Banking Trojan Targets 217 Banking and

Malware and tooling: Rokarolla

Rokarolla is a newly documented Android banking trojan disclosed by Zimperium zLabs on 2026-06-16 that targets 217 banking and cryptocurrency apps and exposes 137 remote commands to its operators. It steals lock-screen PINs/patterns/passwords, intercepts SMS one-time codes, redirects cryptocurrency payments via clipboard hijacking, disables Google Play Protect, and abuses Android Accessibility services for near-total device control.

How Rokarolla Android Banking Trojan Targets 217 Banking and works

Rokarolla is an Android banking and surveillance trojan documented by Zimperium's zLabs research team and reported publicly on 16 June 2026. The family is named after its command-and-control (C2) servers. It is distributed outside the Google Play Store through malicious websites that impersonate well-known applications such as TikTok and Google Chrome. The first stage a victim installs is a dropper that masquerades as 'Google Play Protect', using that disguise to convince the user to install the second-stage payload and to grant Android Accessibility access.

Once Accessibility is granted, Rokarolla gains near-total control of the device. Zimperium counted 137 distinct remote commands in the trojan — more than the 107 commands counted in the HOOK banking trojan — giving an operator the ability to automate UI interaction (tap, longclick, swipe, text injection), capture credentials, and manipulate device state. The malware targets 217 banking and cryptocurrency applications. For each targeted app it downloads a convincing fake HTML login/overlay page from its server, stores it locally, and displays it on top of the legitimate app to harvest credentials and card details. It also presents fake PIN, pattern, and password lock-screen overlays to capture device-unlock secrets.

Financial-fraud capabilities include intercepting SMS one-time passcodes and fraud-alert messages (becoming the device's default SMS and call handler), and rewriting clipboard contents to swap a victim's cryptocurrency wallet address for an attacker-controlled address during transfers. Surveillance capabilities include an automated keylogger, a UI logger, and a pseudo-VNC mechanism that continuously captures screenshots of the victim's screen (exfiltrated as timestamped PNG frames rather than a live video stream, avoiding the visible screen-recording prompt). It scrapes contacts (including from WhatsApp), reads notifications, and can block incoming calls.

For stealth and anti-defense, Rokarolla disables Google Play Protect (the disable_red_alert_for_default and disable_google_play commands), hides its own launcher icon, forces the screen to stay awake, mutes audio/vibration and enables Do Not Disturb to suppress fraud-alert tones, and uses black-screen overlays to mask malicious activity. Its C2 design is resilient: the malware carries multiple fallback C2 domains and can be handed new domains on the fly (the update_config_domen command), limiting the effectiveness of single-server takedowns. Zimperium did not attribute Rokarolla to a named threat actor. There is no associated CVE; this is a mobile malware family, so CVSS is not applicable.

MITRE ATT&CK techniques used in TL-2026-0826

defense-evasion

T1407 Download New Code at Runtime

Collection

T1414 Clipboard Data; T1513 Screen Capture; T1517 Access Notifications; T1636 Protected User Data

Credential Access

T1417 Input Capture

credential-access

T1417.002 GUI Input Capture

Discovery

T1418 Software Discovery; T1426 System Information Discovery

Command and Control

T1437 Application Layer Protocol; T1637 Dynamic Resolution

Initial Access

T1456 Drive-By Compromise; T1660 Phishing

Defense Evasion

T1516 Input Injection; T1628 Hide Artifacts; T1629 Impair Defenses; T1655 Masquerading

Persistence

T1541 Foreground Persistence

impact

T1582 SMS Control

Impact

T1616 Call Control

Execution

T1623 Command and Scripting Interpreter

Privilege Escalation

T1626 Abuse Elevation Control Mechanism

Exfiltration

T1646 Exfiltration Over C2 Channel

Affected products and versions in Rokarolla Android Banking Trojan Targets 217 Banking and

  • Google — Android (devices with sideloading enabled / Accessibility abuse)
    Vulnerable versions: Android (multiple versions; includes Android 16 overlay handling per startoverlay16/liveoverlay16 commands)
  • Multiple — 217 targeted banking and cryptocurrency Android applications
    Vulnerable versions: targeted via fake HTML overlay injects

Remediation for Rokarolla Android Banking Trojan Targets 217 Banking and

Immediate actions

  • Only install Android apps from the official Google Play Store; block sideloading of APKs from unknown sources via MDM policy.
  • Audit devices for apps holding Accessibility Service permission and revoke it from any app that does not legitimately require it.
  • Verify Google Play Protect is enabled and has not been silently disabled on managed devices.
  • Block the known distribution domain (infocontablidades.it.com) and the Rokarolla sample hashes at network and EDR/MTD layers.

Workarounds

  • Disable installation from unknown sources (Settings > Apps > Special access > Install unknown apps).
  • Use hardware-wallet address verification / address allowlists for cryptocurrency transfers to defeat clipboard-swap attacks.

Longer-term hardening

  • Deploy a Mobile Threat Defense (MTD) / mobile EDR solution with behavioral detection for Accessibility abuse and overlay attacks.
  • Enforce SMS-OTP alternatives (FIDO2/passkeys, push-approval, authenticator apps) for banking and crypto authentication.
  • User-awareness training on fake 'update/security' apps and sites impersonating TikTok, Chrome, and Google Play Protect.

Timeline of Rokarolla Android Banking Trojan Targets 217 Banking and

  • Mobile-threat landscape context: tens of millions of mobile malware incidents were blocked throughout 2024 (per Infosecurity Magazine reporting), the backdrop against which Android banking trojans such as Rokarolla proliferate.
  • Zimperium documents HOOK version 3 with 107 remote commands — the prior most-capable Android banking trojan command count, later exceeded by Rokarolla's 137 commands.
  • Zimperium did not attribute Rokarolla to a named threat actor; motivation assessed as financial fraud.
  • Analysts characterize Rokarolla as a shift from pure data theft toward victim isolation — muting alerts, enabling Do Not Disturb, blocking calls, and masking activity with black-screen overlays — improving on the VNC-style surveillance seen in the Klopatra trojan via timestamped-screenshot exfiltration.
  • Confirmed capabilities: lock-screen PIN/pattern/password theft, SMS OTP interception, clipboard-based crypto wallet redirection, Google Play Protect disablement, pseudo-VNC screenshot surveillance, and Accessibility-driven device takeover.
  • Distribution observed via malicious websites impersonating TikTok and Google Chrome (e.g., infocontablidades.it.com), delivering a dropper disguised as Google Play Protect that requests Accessibility access.
  • Family confirmed to target 217 banking and cryptocurrency applications and to expose 137 remote commands, exceeding the 107 commands counted in the HOOK trojan.
  • Zimperium publishes IOCs to its GitHub repository (2026-06-Rokarolla): APK SHA256 sample hashes (apks.csv) and a 137-entry remote command catalog (commands.md).
  • Zimperium zLabs publicly documents the Rokarolla Android banking trojan; coverage published by The Hacker News, Infosecurity Magazine, and Hackread.

Sources cited for Rokarolla Android Banking Trojan Targets 217 Banking and

Threats related to Rokarolla Android Banking Trojan Targets 217 Banking and

Detection coverage for TL-2026-0826

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0826 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats