Rokarolla Banking Trojan

Overview

A newly discovered Android banking trojan named Rokarolla is rapidly emerging as one of the most sophisticated mobile fraud platforms of 2026. Unlike typical malware, Rokarolla combines credential theft, SMS interception, phishing overlays, and device surveillance into a single package, targeting both banking and cryptocurrency users. Researchers at PolySwarm report that the malware already targets 217 financial applications and exposes 137 operator commands, underscoring its scale and financial motivation.

Infection Vector

Rokarolla spreads via malicious websites disguised as legitimate download portals. Victims are tricked into installing fake versions of trusted apps such as:

• TikTok
• Google Chrome
• Google Play Protect

Once installed, the trojan silently requests deep system permissions, enabling it to bypass user awareness and establish persistence.

Capabilities

Rokarolla’s toolkit is extensive, making it one of the most complete mobile fraud platforms seen this year:

• Credential Theft → Harvests login details, PINs, and device unlock passwords.
• Phishing Overlays → HTML‑based fake login screens appear over legitimate apps.
• SMS Interception → Captures one‑time passcodes in real time.
• Accessibility Abuse → Reads on‑screen content, automates actions, and logs keystrokes.
• Clipboard Hijacking → Replaces copied crypto wallet addresses with attacker‑controlled ones.
• Device Surveillance → Takes periodic screenshots and blocks fraud alert calls.

Its fallback command‑and‑control domains ensure resilience, allowing campaigns to continue even if servers are taken down.

Attack Flow

1. Victim downloads a fake app from a malicious site.
2. Rokarolla installs and requests Accessibility permissions.
3. Malware deploys phishing overlays on targeted banking/crypto apps.
4. Credentials, SMS codes, and wallet addresses are harvested.
5. Screenshots and intercepted calls are sent to attacker infrastructure.

Defensive Recommendations

For individuals and organizations:

• Avoid sideloading apps — only install from official stores.
• Scrutinize Accessibility permissions — deny requests from unknown apps.
• Monitor for overlays — suspicious login prompts are red flags.
• Enable multi‑factor authentication — prefer app‑based authenticators over SMS.
• Deploy mobile threat defense — enterprise fleets should enforce strict sideloading policies.

Indicators of Compromise (IoCs)

Researchers published multiple SHA‑256 hashes of Rokarolla samples, including:

• 890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3
• 1ba364113c4cec5542d1b2c76d7c163a66bdf90bc373256d5178f880f9742960
• d7d960ef10b08c472ad397b6fd9e9481338b2077c7c2f44d3dc2c65b19345ae0

These hashes should be integrated into SIEMs, MISP, or VirusTotal for detection and correlation.

Expert in the Cloud Insight

Rokarolla exemplifies the evolution of mobile malware into multi‑function fraud platforms. By combining phishing overlays, SMS interception, and device surveillance, attackers bypass traditional defenses and exploit the weakest link — user trust in familiar apps.

For CISOs and SOC teams, the lesson is clear: mobile endpoints are now primary attack surfaces. Proactive monitoring of Accessibility Service abuse, overlay behavior, and SMS handler modifications must become standard practice in enterprise defense strategies.