CyberShelter Intelligence Brief: Android Banking Malware Targeting UAE Customers Signals Rising Mobile Financial Threat

Fake Chrome and Play Store updates are enabling full account takeover and real-time banking fraud

CyberShelter Threat Intelligence has identified an active and highly targeted Android malware campaign impacting banking users across the UAE.

This campaign uses sophisticated social engineering techniques, disguising malware as legitimate Google Chrome and Google Play Store updates. As a result, users unknowingly install advanced banking trojans that can fully compromise their devices.

The Core Threat: Mobile Banking Under Attack

This campaign involves multiple advanced malware families, including:

• TrickMo
• Antidot
• PhantomCall

These malware variants focus specifically on financial fraud and account takeover.

Once installed, they can:

• Intercept OTPs and SMS messages
• Record screens and capture PINs
• Deploy fake banking overlays
• Gain full remote control of the device

Therefore, attackers can bypass traditional authentication mechanisms and execute fraudulent transactions in real time.

How the Attack Works

The attack follows a structured multi-stage process.

First, attackers distribute malicious APK files through phishing messages, fake app stores, or malicious redirects. Then, users are tricked into granting sensitive permissions such as accessibility access and SMS control.

Next, the malware installs additional payloads and connects to attacker-controlled infrastructure. Finally, it begins harvesting credentials and executing financial fraud.

Because each stage appears legitimate, many users fail to detect the compromise.

Advanced Capabilities That Increase Risk

This campaign stands out due to its advanced techniques.

For example, some variants:

• Block legitimate bank calls
• Suppress security notifications
• Forward calls silently using USSD codes
• Use keylogging and screen recording

Additionally, attackers can maintain persistent access while remaining invisible to the user.

As a result, victims may not realize the compromise until financial loss occurs.

Business and Security Impact

This threat creates serious risks for both users and financial institutions.

Business Impact

• Direct financial losses from fraud
• Increased incident response costs
• Regulatory and compliance exposure
• Damage to brand trust

Security Impact

• OTP-based authentication bypass
• Full session hijacking
• Persistent mobile compromise
• Unauthorized transactions

Because mobile devices act as authentication endpoints, their compromise directly impacts enterprise security.

Why This Threat Is Growing

Several factors contribute to the rise of mobile banking malware:

• Increased reliance on mobile banking
• Continued use of SMS-based authentication
• User trust in app updates
• Lack of mobile security awareness

Meanwhile, attackers continue to evolve techniques to bypass traditional defenses.

Therefore, mobile endpoints are becoming one of the most targeted attack surfaces.

CyberShelter Recommendations

Organizations must act immediately to reduce risk:

• Block all identified malicious indicators
• Prevent sideloading of applications
• Enforce mobile threat defense solutions
• Monitor abnormal banking behavior
• Detect misuse of accessibility services

In addition, organizations should strengthen authentication methods.

Strengthening Authentication Strategy

To reduce fraud risk:

• Move away from SMS-based OTP authentication
• Implement device-bound authentication
• Adopt passkeys where possible
• Use behavioral fraud detection systems

Because attackers increasingly bypass OTPs, stronger identity controls are essential.

Strategic Takeaway

This campaign highlights a major shift in cyber threats.

Attackers are no longer just targeting systems—they are targeting user trust, mobile devices, and authentication flows.

Because in today’s financial threat landscape,
compromising the device means controlling the transaction.