# Vultur Android Banking Malware Expands Capabilities via Brunhilda Dropper (Hybrid SMS + Phone Call Social Engineering)

> Fox-IT (NCC Group) reported a new Vultur Android banking trojan version delivered by the Brunhilda dropper, a trojanized McAfee Security app (com.wsandroid.suite), via telephone-oriented attack delivery (SMS plus phone call). New capabilities include Accessibility Services-based remote control, file management, app blocking, keyguard bypass, 7 new C2 methods and 41 new FCM commands.

- **Published:** 2026-10-16T22:26:22Z
- **Last reviewed:** 2026-10-16T22:26:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3783
- **ID:** TL-2026-3783
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Fox-IT (NCC Group) analyzed a March 2024 Vultur campaign that begins with an SMS claiming an unauthorized transaction and directing the victim to call a number. During the call the fraudster sends a second SMS containing a link to a modified McAfee Security app (package com.wsandroid.suite) that carries the Brunhilda dropper framework. Brunhilda is offered as a dropper-as-a-service and previously reached victims through Google Play dropper apps posing as authenticator and productivity tools. Distribution domains observed follow the pattern mcafee.NNNNNN.com.

The dropper registers the device with its C2 (endpoint /ejr/, method application.register, campaign tag dropper2, device model, Android version and Base64-encoded installed-app list) and then decrypts and deploys three Vultur payloads in sequence: two APKs and one DEX. Payload #1 prompts the victim, with custom HTML, to enable an Accessibility Service and installs Payload #2. Payload #2 provides remote access through AlphaVNC and ngrok, uses a spoofed com.google.android.marvin.talkback Accessibility Service name, stores configuration in encrypted SharedPreferences, and decrypts Payload #3 (AES/CFB/NoPadding). Payload #3 (DEX) implements all C2 methods and the FCM command handlers. Payloads #1 and #2 are decrypted by native C/C++ code (AES/ECB/PKCS5Padding) with keys derived from embedded Base64 strings.

C2 communication uses JSON-RPC style methods (for example vnc.register, vnc.status, vnc.apps, vnc.keylog, vnc.config, vnc.overlay, vnc.overlay.logs, vnc.snapshot, vnc.urls, crash.logs, vnc.syslog) sent AES-encrypted and Base64-encoded over HTTPS to /ejr/. New methods are vnc.pattern, vnc.blocked.packages, vnc.fm and installer.config. Files and screen recordings go to /upload/, and ngrok is fetched from /version/app/?filename=ngrok&arch={arch}. Firebase Cloud Messaging carries the C2-to-device commands. There are 41 new FCM commands covering back/home/recents, click, scroll, swipe, set text, screen recording, wake lock with keyguard disable and swipe unlock, keyboard visibility, storage and unknown-sources permission handling, power menu long press, black-screen overlay, WebView display, custom notifications, C2 domain update (announcement), blocked-package retrieval and file manager operations (download, upload, delete, install, find).

Samples reference banking and other apps including pt.novobanco.nbapp, pt.santandertotta.mobileparticularese, sa.alrajhibank.tahweelapp, sa.com.sctpay, uk.co.hsbc.hsbcukmobilebanking, uk.co.metrobankonline.mobile.android.production, uk.co.santander.santanderUK, uk.co.tescomobile.android, se.swedbank.mobil and us.zoom.videomeetings. Press coverage reports Vultur variants targeted 122 banking apps across 15 countries by end of 2023, with victims primarily in Europe and North America and also India and Japan. Fox-IT assigned no CVE or CVSS; severity is analyst-assigned.

## MITRE ATT&CK

- T1660 Phishing
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1406 Obfuscated Files or Information
- T1633.001 Virtualization/Sandbox Evasion: System Checks
- T1575 Native API
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1513 Screen Capture
- T1516 Input Injection
- T1418 Software Discovery
- T1426 System Information Discovery
- T1420 File and Directory Discovery
- T1437.001 Application Layer Protocol: Web Protocols
- T1521.001 Encrypted Channel: Symmetric Cryptography
- T1544 Ingress Tool Transfer
- T1646 Exfiltration Over C2 Channel

## Sources

- [Android malware Vultur expands its wingspan (Fox-IT / NCC Group)](https://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan/)
- [Vultur banking malware for Android poses as McAfee Security app (BleepingComputer)](https://www.bleepingcomputer.com/news/security/vultur-banking-malware-for-android-poses-as-mcafee-security-app/)
- [Android Banking Trojan Vultur Returns With New Features (The Hacker News)](https://thehackernews.com/2024/04/vultur-android-banking-trojan-returns.html)
- [Hackers Update Vultur Banking Malware With Remote Controls (BankInfoSecurity)](https://www.bankinfosecurity.com/hackers-update-vultur-banking-malware-remote-controls-a-24760)
- [Vultur Android malware poses as McAfee (Cyber Security News)](https://cybersecuritynews.com/vultur-android-malware-mcafee-limitation/amp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3783