Threat reportMalwareTL-2026-3783
Vultur Android Banking Malware Expands Capabilities via Brunhilda Dropper (Hybrid SMS + Phone Call Social Engineering)
Vultur Android Banking Malware Expands Capabilities via (TL-2026-3783), also tracked as Brunhilda dropper, is a high-severity malware campaign, first published 2026-10-16. It has no confirmed attribution, affects Google Android, maps to 16 MITRE ATT&CK techniques (T1406, T1417.001, T1417.002), and is covered by 9 detection rules and 33 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 33Indicators of compromise
Key facts for TL-2026-3783
- Threat ID
- TL-2026-3783
- Also known as
- Brunhilda dropper, TOAD campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, consumer
- Target regions
- Europe, North America, Middle East, south africa, united kingdom, india, japan
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in Vultur Android Banking Malware Expands Capabilities via
Malware and tooling: Brunhilda, Vultur, VNC, ngrok - S0508
How Vultur Android Banking Malware Expands Capabilities via works
Fox-IT (NCC Group) reported a new Vultur Android banking trojan version delivered by the Brunhilda dropper, a trojanized McAfee Security app (com.wsandroid.suite), via telephone-oriented attack delivery (SMS plus phone call). New capabilities include Accessibility Services-based remote control, file management, app blocking, keyguard bypass, 7 new C2 methods and 41 new FCM commands.
Fox-IT (NCC Group) analyzed a March 2024 Vultur campaign that begins with an SMS claiming an unauthorized transaction and directing the victim to call a number. During the call the fraudster sends a second SMS containing a link to a modified McAfee Security app (package com.wsandroid.suite) that carries the Brunhilda dropper framework. Brunhilda is offered as a dropper-as-a-service and previously reached victims through Google Play dropper apps posing as authenticator and productivity tools. Distribution domains observed follow the pattern mcafee.NNNNNN.com.
The dropper registers the device with its C2 (endpoint /ejr/, method application.register, campaign tag dropper2, device model, Android version and Base64-encoded installed-app list) and then decrypts and deploys three Vultur payloads in sequence: two APKs and one DEX. Payload #1 prompts the victim, with custom HTML, to enable an Accessibility Service and installs Payload #2. Payload #2 provides remote access through AlphaVNC and ngrok, uses a spoofed com.google.android.marvin.talkback Accessibility Service name, stores configuration in encrypted SharedPreferences, and decrypts Payload #3 (AES/CFB/NoPadding). Payload #3 (DEX) implements all C2 methods and the FCM command handlers. Payloads #1 and #2 are decrypted by native C/C++ code (AES/ECB/PKCS5Padding) with keys derived from embedded Base64 strings.
C2 communication uses JSON-RPC style methods (for example vnc.register, vnc.status, vnc.apps, vnc.keylog, vnc.config, vnc.overlay, vnc.overlay.logs, vnc.snapshot, vnc.urls, crash.logs, vnc.syslog) sent AES-encrypted and Base64-encoded over HTTPS to /ejr/. New methods are vnc.pattern, vnc.blocked.packages, vnc.fm and installer.config. Files and screen recordings go to /upload/, and ngrok is fetched from /version/app/?filename=ngrok&arch={arch}. Firebase Cloud Messaging carries the C2-to-device commands. There are 41 new FCM commands covering back/home/recents, click, scroll, swipe, set text, screen recording, wake lock with keyguard disable and swipe unlock, keyboard visibility, storage and unknown-sources permission handling, power menu long press, black-screen overlay, WebView display, custom notifications, C2 domain update (announcement), blocked-package retrieval and file manager operations (download, upload, delete, install, find).
Samples reference banking and other apps including pt.novobanco.nbapp, pt.santandertotta.mobileparticularese, sa.alrajhibank.tahweelapp, sa.com.sctpay, uk.co.hsbc.hsbcukmobilebanking, uk.co.metrobankonline.mobile.android.production, uk.co.santander.santanderUK, uk.co.tescomobile.android, se.swedbank.mobil and us.zoom.videomeetings. Press coverage reports Vultur variants targeted 122 banking apps across 15 countries by end of 2023, with victims primarily in Europe and North America and also India and Japan. Fox-IT assigned no CVE or CVSS; severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3783
Defense Evasion
T1406 Obfuscated Files or Information; T1633.001 Virtualization/Sandbox Evasion: System Checks; T1655.001 Masquerading: Match Legitimate Name or Location
Credential Access
T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture
Discovery
T1418 Software Discovery; T1420 File and Directory Discovery; T1426 System Information Discovery
Command and Control
T1437.001 Application Layer Protocol: Web Protocols; T1521.001 Encrypted Channel: Symmetric Cryptography; T1544 Ingress Tool Transfer
Collection
defense-evasion
Execution
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in Vultur Android Banking Malware Expands Capabilities via
- Google — Android
Vulnerable versions: Devices where the user sideloads the trojanized app and grants Accessibility Service
Remediation for Vultur Android Banking Malware Expands Capabilities via
Immediate actions
- Block the C2 domains safetyfactor.online and cloudmiracle.store and the mcafee.NNNNNN.com distribution domains at DNS and proxy
- Alert on and block Android sideloading of com.wsandroid.suite from outside Google Play
- Instruct customers and staff that banks and McAfee never send app links during a phone call following an SMS fraud alert
- Hunt MDM/EMM inventory for the listed package names and SHA-256 hashes
Workarounds
- Remove the app, revoke Accessibility and Device Admin permissions, factory reset if infection is confirmed, and change banking credentials from a clean device
- Banks should apply behavioral fraud detection for remote-access (VNC/ngrok) driven sessions
Longer-term hardening
- Enforce Play Protect and block installation from unknown sources on managed devices
- Restrict Accessibility Service grants to allow-listed apps via MDM
- Deploy mobile threat defense detecting accessibility abuse, overlays and screen recording
- Run customer awareness on telephone-oriented attack delivery (TOAD)
Timeline of Vultur Android Banking Malware Expands Capabilities via
- ThreatFabric first documented Vultur (March 2021; day approximate)
- Brunhilda dropper adopted AES string obfuscation (October 2022; day approximate)
- Vultur observed distributed via Google Play dropper apps posing as authenticator and productivity tools (late 2022; day approximate)
- By end of 2023 Vultur ranked among the top 10 active banking trojans; nine variants targeted 122 banking apps in 15 countries per press reporting (day approximate)
- Fox-IT observed new Vultur version delivered via SMS plus phone call with a trojanized McAfee Security app (March 2024; day approximate)
- Fox-IT (NCC Group) published 'Android malware Vultur expands its wingspan' with IOCs
- The Hacker News and other outlets covered the Vultur update (day approximate)
Sources cited for Vultur Android Banking Malware Expands Capabilities via
- Android malware Vultur expands its wingspan (Fox-IT / NCC Group)
- Vultur banking malware for Android poses as McAfee Security app (BleepingComputer)
- Android Banking Trojan Vultur Returns With New Features (The Hacker News)
- Hackers Update Vultur Banking Malware With Remote Controls (BankInfoSecurity)
- Vultur Android malware poses as McAfee (Cyber Security News)
Detection coverage for TL-2026-3783
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3783 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.