# Rokarolla Android Banking Trojan Intercepts SMS OTPs and Enables Full Device Takeover Across 217+ Banking and Crypto Apps

> Rokarolla is an Android banking trojan distributed via fake app-download sites impersonating TikTok, Google Chrome, and Google Play Protect. It abuses Accessibility Services to run HTML phishing overlays, intercept SMS OTPs, log keystrokes, capture screenshots, hijack clipboard crypto addresses, and block fraud-warning calls, targeting 217+ banking/crypto apps via 137 operator commands and multiple fallback C2 domains.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1225
- **ID:** TL-2026-1225
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Rokarolla is a newly documented Android banking trojan first analyzed by Zimperium zLabs (published 2026-06-16) and independently reported by PolySwarm, with subsequent coverage from Cyber Security News, BleepingComputer, The Hacker News, Help Net Security, Malwarebytes, GBHackers, and Infosecurity Magazine (late June 2026). The malware is distributed through malicious websites carefully designed to impersonate legitimate software download portals for TikTok, Google Chrome, and Google Play Protect. Victims who visit these sites are lured into sideloading a dropper APK that masquerades as Google Play Protect; the dropper then installs a second-stage payload while requesting SMS access, the default SMS-handler role, call-handler role, notification-listener access, and Android Accessibility Service permissions.

Once Accessibility Service access is granted, Rokarolla gains near-total control of the device without needing further user interaction. It parses on-screen UI nodes and coordinates to identify which app is in the foreground, and when the victim opens one of at least 217 targeted banking or cryptocurrency applications, the malware downloads and renders an HTML-based phishing overlay tailored to that specific app (researchers observed a fake overlay mimicking the Spanish 'imagin' banking app, a CaixaBank digital-banking brand). These overlays are rendered nearly identical to the legitimate login screens and are used to harvest usernames, passwords, PINs, patterns, and payment-card data, including fraudulent Android lock-screen overlays used to capture device unlock credentials directly.

Beyond overlay phishing, Rokarolla intercepts and can send SMS messages in real time, allowing it to steal one-time passcodes used for two-factor authentication and transaction approval before the victim ever sees them. It abuses Accessibility Services for silent keylogging and on-screen text extraction (including harvesting WhatsApp contacts), monitors and swaps clipboard content to redirect cryptocurrency transfers to attacker-controlled wallet addresses, and can block or intercept incoming phone calls to suppress bank fraud-warning calls. For visual surveillance, rather than using the conventional Android MediaProjection screen-recording API (which would trigger a visible recording indicator), Rokarolla implements a snapshot-based mechanism: it periodically captures the screen via Accessibility, compresses frames to PNG, and exfiltrates them one at a time to the C2 server, resetting state and cleaning up after each transmission.

For persistence and evasion, Rokarolla attempts to disable Google Play Protect, hides its app icon after installation, suppresses notifications and vibration, and keeps the display forced on to prevent screen-timeout interruptions to its background operations. On first contact with its command-and-control infrastructure over HTTPS, the malware transmits a device fingerprint/telemetry profile (phone model, Android version, locale, display characteristics, battery level, storage capacity, and available RAM) to generate a unique bot ID, then queries the C2 for the current list of 217 targeted banking/cryptocurrency apps along with corresponding phishing overlay resources and injection status values. The malware exposes at least 137 distinct operator commands spanning surveillance, credential exfiltration, SMS/call manipulation, clipboard hijacking, and device management, and supports multiple fallback C2 domains with dynamically-updatable configuration for resilience against takedown. Observed C2 domains include beralisvc.info, blestorians.cfd, abiorime.cfd, and morevoms.cfd; a fake distribution site impersonating TikTok/Chrome was identified at infocontablidades.it.com. No CVE applies (this is malware distribution/behavior, not a software vulnerability), and no specific threat-actor group name or nation-state attribution has been published; the financially-motivated targeting of banking and crypto credentials is consistent with a cybercriminal fraud operation rather than state-sponsored activity. Zimperium published a companion GitHub IOC repository containing sample APK hashes and the full list of 137 operator commands.

## MITRE ATT&CK

- T1660 Phishing
- T1476 Deliver Malicious App via Other Means
- T1624 Event Triggered Execution
- T1541 Foreground Persistence
- T1626 Abuse Elevation Control Mechanism
- T1655 Masquerading
- T1516 Input Injection
- T1629.003 Disable or Modify Tools
- T1628.002 User Evasion
- T1417 Input Capture
- T1517 Access Notifications
- T1418 Software Discovery
- T1426 System Information Discovery
- T1513 Screen Capture
- T1636 Protected User Data
- T1414 Clipboard Data
- T1616 Call Control
- T1637 Dynamic Resolution
- T1481 Web Service
- T1646 Exfiltration Over C2 Channel
- T1582 SMS Control
- T1642 Endpoint Denial of Service

## Sources

- [Hackers Use Rokarolla Banking Trojan to Intercept SMS Codes and Steal Crypto Credentials](https://cybersecuritynews.com/hackers-use-rokarolla-banking-trojan-to-intercept-sms-codes/)
- [Beyond Banking Trojans: Rokarolla Expands the Android Fraud Playbook](https://blog.polyswarm.io/beyond-banking-trojans-rokarolla-expands-the-android-fraud-playbook)
- [Rokarolla: Android Banker with Complete Device Takeover Capabilities](https://www.zimperium.com/blog/rokarolla-android-banker-with-complete-device-takeover-capabilities)
- [New Rokarolla Android malware targets 217 banking, crypto apps](https://www.bleepingcomputer.com/news/security/new-rokarolla-android-malware-targets-217-banking-crypto-apps/)
- [New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds](https://thehackernews.com/2026/06/new-rokarolla-android-malware-steals.html)
- [Rokarolla Android trojan targets banking and crypto users, enables device takeover](https://www.helpnetsecurity.com/2026/06/17/rokarolla-android-banking-trojan-device-takeover/)
- [Rokarolla Uses Fake Google Play Protect App to Target Banking and Cryptocurrency Users](https://gbhackers.com/rokarolla-uses-fake-google-play-protect/)
- [Rokarolla Trojan Combines Banking Fraud With Device Surveillance](https://www.infosecurity-magazine.com/news/rokarolla-android-banking-trojan/)
- [Rokarolla Android malware can take over your phone and steal banking logins](https://www.malwarebytes.com/blog/mobile/2026/06/rokarolla-android-malware-can-take-over-your-phone-and-steal-banking-logins)
- [Zimperium/IOC GitHub repository - 2026-06-Rokarolla](https://github.com/Zimperium/IOC/tree/master/2026-06-Rokarolla/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1225