# Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commands

> Rokarolla is a newly documented Android banking trojan disclosed by Zimperium zLabs on 2026-06-16 that targets 217 banking and cryptocurrency apps and exposes 137 remote commands to its operators. It steals lock-screen PINs/patterns/passwords, intercepts SMS one-time codes, redirects cryptocurrency payments via clipboard hijacking, disables Google Play Protect, and abuses Android Accessibility services for near-total device control.

- **Published:** 2026-06-16T00:00:00Z
- **Last reviewed:** 2026-06-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0826
- **ID:** TL-2026-0826
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Rokarolla is an Android banking and surveillance trojan documented by Zimperium's zLabs research team and reported publicly on 16 June 2026. The family is named after its command-and-control (C2) servers. It is distributed outside the Google Play Store through malicious websites that impersonate well-known applications such as TikTok and Google Chrome. The first stage a victim installs is a dropper that masquerades as 'Google Play Protect', using that disguise to convince the user to install the second-stage payload and to grant Android Accessibility access.

Once Accessibility is granted, Rokarolla gains near-total control of the device. Zimperium counted 137 distinct remote commands in the trojan — more than the 107 commands counted in the HOOK banking trojan — giving an operator the ability to automate UI interaction (tap, longclick, swipe, text injection), capture credentials, and manipulate device state. The malware targets 217 banking and cryptocurrency applications. For each targeted app it downloads a convincing fake HTML login/overlay page from its server, stores it locally, and displays it on top of the legitimate app to harvest credentials and card details. It also presents fake PIN, pattern, and password lock-screen overlays to capture device-unlock secrets.

Financial-fraud capabilities include intercepting SMS one-time passcodes and fraud-alert messages (becoming the device's default SMS and call handler), and rewriting clipboard contents to swap a victim's cryptocurrency wallet address for an attacker-controlled address during transfers. Surveillance capabilities include an automated keylogger, a UI logger, and a pseudo-VNC mechanism that continuously captures screenshots of the victim's screen (exfiltrated as timestamped PNG frames rather than a live video stream, avoiding the visible screen-recording prompt). It scrapes contacts (including from WhatsApp), reads notifications, and can block incoming calls.

For stealth and anti-defense, Rokarolla disables Google Play Protect (the disable_red_alert_for_default and disable_google_play commands), hides its own launcher icon, forces the screen to stay awake, mutes audio/vibration and enables Do Not Disturb to suppress fraud-alert tones, and uses black-screen overlays to mask malicious activity. Its C2 design is resilient: the malware carries multiple fallback C2 domains and can be handed new domains on the fly (the update_config_domen command), limiting the effectiveness of single-server takedowns. Zimperium did not attribute Rokarolla to a named threat actor. There is no associated CVE; this is a mobile malware family, so CVSS is not applicable.

## MITRE ATT&CK

- T1660 Phishing
- T1456 Drive-By Compromise
- T1623 Command and Scripting Interpreter
- T1407 Download New Code at Runtime
- T1541 Foreground Persistence
- T1626 Abuse Elevation Control Mechanism
- T1655 Masquerading
- T1629 Impair Defenses
- T1628 Hide Artifacts
- T1516 Input Injection
- T1582 SMS Control
- T1417 Input Capture
- T1417.002 GUI Input Capture
- T1418 Software Discovery
- T1426 System Information Discovery
- T1513 Screen Capture
- T1517 Access Notifications
- T1414 Clipboard Data
- T1636 Protected User Data
- T1437 Application Layer Protocol
- T1637 Dynamic Resolution
- T1646 Exfiltration Over C2 Channel
- T1616 Call Control

## Sources

- [New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds](https://thehackernews.com/2026/06/new-rokarolla-android-malware-steals.html)
- [Rokarolla Trojan Combines Banking Fraud With Device Surveillance](https://www.infosecurity-magazine.com/news/rokarolla-android-banking-trojan/)
- [New Rokarolla Android Trojan Found Targeting 217 Crypto and Banking Apps](https://hackread.com/rokarolla-android-trojan-crypto-and-banking-apps/)
- [Zimperium zLabs IOC repository (root)](https://github.com/Zimperium/IOC)
- [Zimperium IOC - 2026-06-Rokarolla sample hashes (apks.csv)](https://github.com/Zimperium/IOC/tree/master/2026-06-Rokarolla)
- [Zimperium IOC - 2026-06-Rokarolla command catalog (commands.md)](https://raw.githubusercontent.com/Zimperium/IOC/master/2026-06-Rokarolla/commands.md)
- [Hook Version 3: The Banking Trojan with the Most Advanced Capabilities (Zimperium, command-count baseline reference)](https://zimperium.com/blog/hook-version-3-the-banking-trojan-with-the-most-advanced-capabilities)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0826