New Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a Human

A new Android banking trojan, Herodotus, is actively targeting financial institutions and cryptocurrency platforms across Europe, the US, and Brazil, employing sophisticated device takeover techniques that mimic human behavior to bypass biometric detection and persist in live sessions. This malware, advertised as a service, leverages accessibility features to steal credentials and 2FA codes. Concurrently, GhostGrab, another advanced Android malware, is targeting Indian users by combining banking credential theft with covert Monero cryptocurrency mining, creating a dual-revenue stream for threat actors. These developments highlight the escalating sophistication of mobile banking malware and the persistent cybersecurity risks to financial services and their clientele.

Analysis

A new Android banking trojan, Herodotus, has been identified in active campaigns targeting Italy, Brazil, and potentially expanding to the U.S., U.K., Turkey, and Poland, as well as cryptocurrency platforms. This malware, advertised via a malware-as-a-service (MaaS) model since September 2025, employs sophisticated device takeover (DTO) techniques, mimicking human behavior with random delays (300-3000ms) to bypass biometric detection and persist in live sessions. This represents a significant evolution in mobile malware capabilities, aiming to evade timing-based anti-fraud solutions.

Herodotus leverages Android accessibility services to conduct credential theft, intercept 2FA codes, and display bogus login screens over financial apps. It shares obfuscation techniques and direct mentions with the Brokewell banking Trojan, indicating a sophisticated lineage and continuous development in mobile malware. Its design to persist in live sessions rather than just steal static credentials highlights a more insidious threat model.

Concurrently, another advanced Android malware, GhostGrab, is targeting Indian users, combining banking credential harvesting with covert Monero cryptocurrency mining, creating a 'dual-revenue stream' for threat actors. This malware utilizes dropper apps impersonating financial services to request high-risk permissions and steal sensitive data including ATM PINs and government IDs. These developments underscore a significant escalation in the sophistication and monetization strategies of mobile banking malware, posing increased risks to financial institutions and their customers globally.

Key Decisions for Investors

• Investors in cybersecurity and fintech should anticipate increased demand for advanced mobile threat detection, behavioral biometrics, and anti-fraud solutions, given the evolving sophistication of malware like Herodotus and GhostGrab.
• Financial institutions must prioritize investments in robust mobile security frameworks, continuous threat intelligence, and enhanced user education to mitigate device takeover and credential theft risks.
• Companies with significant Android-based customer interactions, especially in targeted regions and those handling sensitive financial or cryptocurrency data, should reassess their cybersecurity risk profiles and allocate capital towards proactive defense mechanisms and platform security.