Rokarolla Uses Fake Google Play Protect App to Target Banking and Cryptocurrency Users

Rokarolla, a sophisticated Android banking trojan distributed via malicious websites that masquerade as trusted applications such as TikTok, Google Chrome and even Google Play Protect.

Unlike simple credential stealers, Rokarolla is a multi-functional fraud platform that targets at least 217 banking and cryptocurrency apps and combines Accessibility Service abuse, phishing overlays, SMS interception, keylogging, screenshot monitoring and call manipulation to achieve near-complete control over infected devices.

Initial deployment relies on social-engineered sideloading. Victims are lured to fake download portals where the dropper installs a second-stage payload disguised as Google Play Protect to lower user suspicion.

Once installed, Rokarolla aggressively requests Accessibility Service permissions along with access to SMS, notifications and other sensitive capabilities. Those permissions are the pivot for its core capabilities: parsing user interfaces, automating interactions, displaying HTML-based overlays and harvesting credentials.

The trojan maintains persistent and resilient command-and-control communications over HTTPS and collects extensive device telemetry hardware details, Android version, localization, battery and storage to generate a unique device profile.

Researchers observed dynamic remote configuration and multiple fallback C2 domains, enabling operators to update target lists, phishing resources and operational parameters on the fly.

Primary credential theft is achieved through overlay-based phishing. When a targeted banking or crypto app launches, Rokarolla can display a counterfeit HTML login dialog that closely mimics the legitimate interface.

Polyswarm said in a report shared with GBhackers, Rokarolla exposes at least 137 operator commands that permit granular remote actions, from surveillance and credential exfiltration to device management and fraud facilitation.

Users who enter usernames, passwords or payment details into these overlays send that data directly to attacker infrastructure.

Rokarolla Uses Fake Google Play Protect

The malware also deploys lock-screen overlays designed to harvest device unlock credentials PINs, passwords and patterns further expanding attackers’ access options.

Communications interception is extensive. Rokarolla can exfiltrate SMS messages, send messages from the device, and capture one-time passcodes delivered via SMS.

It can also block or intercept phone calls, undermining fraud alerts and verification calls that might otherwise notify victims or disrupt attacker activity.

Clipboard manipulation features were noted as well; these can replace cryptocurrency addresses or other copied values to divert transactions.

Surveillance functions include keylogging, user interface logging, on-screen text extraction, WhatsApp contact harvesting, screenshot collection and periodic snapshot-based screen monitoring.

Instead of streaming video, the malware compresses and transmits PNG screenshots with timestamps an efficient method to observe user activity while conserving resources and reducing detection risk.

Evasion and persistence techniques are numerous: attempts to disable Google Play Protect, hide application icons, suppress audio and vibration notifications, keep the display active, and obstruct user interaction with deceptive overlays. These behaviors reduce the likelihood of discovery and interruption.

Rokarolla exemplifies the evolution of Android banking malware into comprehensive fraud-enablement platforms. Its modular design, dynamic configuration and extensive command surface make it adaptable and resilient.

Defenders should prioritize telemetry and detection rules for unauthorized Android Accessibility Service usage, suspicious overlay activity, SMS handler changes, unexpected call-control permissions and sideloading indicators.

Threat intelligence sources such as Zimperium’s analysis and community platforms like PolySwarm provide actionable IOC sets and behavioral indicators to accelerate detection and response.

Users should avoid sideloading, verify app sources in Google Play, enable Play Protect and limit Accessibility permissions to trusted applications.

Organizations should monitor for anomalous accessibility grants and SMS or call-management privilege changes to reduce the risk posed by this emerging threat.

IOCs

890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3 1ba364113c4cec5542d1b2c76d7c163a66bdf90bc373256d5178f880f9742960 d7d960ef10b08c472ad397b6fd9e9481338b2077c7c2f44d3dc2c65b19345ae0 57307ee8a3cda10730eacecaf789fab6f8771f9d29397e07c31a6bd4551bba10 3fae7ede2ef9c809b54504c3d78e5111d7fad0b522c707b8f6ff21015af79251 fe41e6c1725f63582f022a17abe098e49338a78118a00ca87785b2fa0cf3dadf be8573971b85fda81a2fac27adb7a3a9b2cf7e1d9bdf713361a725324d378d34 5139253b1f30b34ab3aa888aba175866fa1f82728ab07b999c24b49b191c3f68 43888be8debbbd74012484d4e4f9a1c70c2ff3970e0bf499c9aebba9776930a1 a5e6763b09553691c8b42deefb725fa3b8c133a03a34cea87740b1f13d08bac3 1d3270a9141f8f16047799f1132633d72fd421b6c8f1878b5ef04ced6add4db8 62aef76c2d1897203649844b45317d9e1723819479a2b88ca4b3290ca9f4c9f0 48a3db92fac1ba9c218253576e09f42faabeaf48cf80663cf32e06b0a66e983d 726095e56c693977b7796dc7cead2e2a49551d77d3f442aaa28997615ba07e99 c3cfe522d2da15b033f65eb5377bf9e99be598dc4c21729e6f168dbc8f19540b 3e25c28c5e93376683e841b7ad60f9383bb3bf831284a93a4aae798fc769d767 8d65e4df0ad369f491698437413afd1bd55fff309860f9cdecc778c9ac062282 c08cd3f78c0edcced6b1a694284b6ed4a9e0422f469e07c702c4a8d1f6c186f4 696ef29f77a91aa91279c83088a07ab137d5049dc096ef862a35f9d890a552b3 8ddbcebe1014a645855986e85b2c54ee167baf1e9a0d74179faf81a5ee6878f4 1e4ed7e40608750cd0bfe96f5ed493a022b58ec54da2345336c522f7c78197af c505353a6c58a21cb7b0343202e8629bee2f121f01c21dd8e0b61b7c55b77495 aec2a36e8d68b23444348a7cec2d6ec287cb8810d1e190e04743645426ababb1 f49be77b95cabd28d2dfe91786863576f6bd3f43a9d6de67a5b5851afe3aff9a e76cbdf420540a18e2ddea02938acf3c4b4139f3511d314dca9781afe1e439bb c3e324106803df27f5b6e0d49d2daf02d4cde396af4401f1ad29d78198e370b6 ed036356fa2d3490d3ddb5ee7ae98bab80b505938f0199d9b10f12266f345896 d6403ec82659eb62424bb1033615a8df27635080d02e438a4ee7e2334b1155f7 c734a665f04eb9ab17047e65940fc35bad0221d59c2fc4fd0d170f2181514034 e134cffcbe1fa8a861fd1f9a506f10ca5ff56cd5082360ef13d204676792e8bc f0c18f045e3bb0193ef1169f5fa1abff7aa47e9a23da35cf67bbb9548a5e32c0 f8cb375a4129358ad5881c29a6921fc1e5773028c0b31da83298f606118b185a 3c304a1ac73590aaf94b62711a5f2fd0cbb863dab13aef6ec1eb156f4a7bd5b9 2eb80e5519fc6defcec8cc30a5cf4f75ee5ec8d2435759bb77c19826f1e20efb 1f4c70cb317ffd25adc828fbac3bb8f07739e23111f7b7905926489fe35f8973

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.