{"id":398648,"date":"2026-08-02T04:07:05","date_gmt":"2026-08-02T04:07:05","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=398648"},"modified":"2026-08-02T04:07:05","modified_gmt":"2026-08-02T04:07:05","slug":"rokarolla-android-banking-trojan-how-the-fake-tiktok-18-app-takes-control","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/rokarolla-android-banking-trojan-how-the-fake-tiktok-18-app-takes-control\/","title":{"rendered":"Rokarolla Android Banking Trojan: How the Fake TikTok 18+ App Takes Control"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>A TikTok 18+ app promises age-restricted videos, then asks for powerful Accessibility permissions. It is not TikTok. It is Rokarolla, an Android banking trojan built to watch and control the phone.<\/strong><\/p><div id=\"mwtad726647873\" class=\"gas_fallback-ad_309684--placement_360520\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3957935887\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">If this app is installed, stop using the device for banking or passwords. Disconnect it, revoke the dangerous permissions and remove the malware before securing your accounts from a clean device.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1672\" height=\"941\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/rokarolla-android-banking-trojan.png\" alt=\"Rokarolla Android banking trojan abusing Accessibility permissions and stealing credentials\" class=\"wp-image-398639\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/rokarolla-android-banking-trojan.png 1672w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/rokarolla-android-banking-trojan-300x169.png 300w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/rokarolla-android-banking-trojan-1024x576.png 1024w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/08\/rokarolla-android-banking-trojan-1536x864.png 1536w\" sizes=\"(max-width: 1672px) 100vw, 1672px\" \/><figcaption class=\"wp-element-caption\">Rokarolla disguises itself as a TikTok 18+ app and abuses Android permissions to steal banking credentials, messages and unlock codes.<\/figcaption><\/figure>\n\n\n\n<div id=\"mwtad945712278\" class=\"gas_fallback-ad_309746-ad_309691-placement_360521\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"4456629336\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Rokarolla is a dangerous Android banking trojan distributed through a fake application branded as <strong>TikTok 18+<\/strong>. The lure suggests users must install a special app and complete age verification to see restricted content. TikTok does not require an unofficial APK for adult access.<\/p><div id=\"mwtad771749411\" class=\"gas_fallback-ad_381396-ad_309691-placement_360566\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"1471373341\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">After installation, the app shows a fake Google Play Protect scan and asks the user to grant Accessibility access. That permission is the turning point. Accessibility Services are designed to help people interact with their phones, but malware can abuse them to read screen content, press buttons, approve prompts and monitor other apps.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Security researchers have documented <strong>137 remote commands<\/strong> supported by Rokarolla. The trojan can parse and control the user interface, display overlays above banking and cryptocurrency apps, record typed information and capture the device PIN or unlock pattern.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It can also harvest SMS messages, WhatsApp contacts and call information. By becoming the default SMS or phone app, Rokarolla may intercept one-time codes, send messages from the victim&#8217;s number and block incoming calls that could warn the owner about fraud.<\/p><div id=\"mwtad1579298004\" class=\"gas_fallback-ad_309686-ad_309691-placement_360569\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6935453015\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The malware works hard to remain unnoticed. It can disable Play Protect, hide its launcher icon, mute sound and vibration, keep the screen awake and communicate with command servers over encrypted HTTPS connections. A unique bot identifier and device profile help criminals manage each infected phone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is not a questionable app with aggressive advertising. <strong>Rokarolla is credential-stealing, device-controlling malware.<\/strong> Anyone who installed the fake TikTok 18+ APK should treat banking, email, cryptocurrency and other sensitive accounts used on the phone as potentially exposed.<\/p>\n\n\n\n<div id=\"mwtad3209447505\" class=\"gas_fallback-ad_309747-ad_309691-placement_360587\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9589536513\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">How the Rokarolla Android Trojan Infects a Phone<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: A fake TikTok 18+ offer leads outside Google Play<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The victim encounters a website, advertisement, direct message or download page promising age-restricted TikTok content. It instructs the user to install an APK from outside the official Play Store.<\/p><div id=\"mwtad688302596\" class=\"gas_fallback-ad_381401-ad_309691-placement_360573\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5315249587\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: The app uses fake verification screens<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The application copies TikTok branding and may display an age check or a counterfeit Google Play Protect scan. These screens create a sense that the app is being verified when the security process is entirely controlled by the malware.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Accessibility access gives the malware control<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Rokarolla asks for permission to observe and control the screen. The request may be described as necessary for verification, playback or security. Once granted, the trojan can interact with buttons and forms across other applications.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: The icon disappears and protections are weakened<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The malware can hide its launcher icon and attempt to disable Play Protect. It may also silence alerts or keep the display awake, making remote activity easier to conduct without attracting attention.<\/p><div id=\"mwtad1789938324\" class=\"gas_fallback-ad_381404-ad_309691-placement_381406\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8735619847\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Fake overlays steal financial credentials<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When the victim opens a targeted banking or cryptocurrency app, Rokarolla can place a counterfeit login window above the genuine app. Usernames, passwords, PINs and card details entered into the overlay are captured.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Messages, calls and one-time codes are intercepted<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The trojan can access SMS content and manipulate phone functions. This can expose one-time passwords and suppress calls from banks, while allowing criminals to send messages that appear to come from the infected number.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Remote operators control the infection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The phone connects to command-and-control infrastructure and receives instructions. Backup domains help the operation continue when one server is blocked. Attackers can adapt their actions to the victim&#8217;s installed apps and financial value.<\/p><div id=\"mwtad760629347\" class=\"gas_fallback-ad_360582-ad_309691-placement_360581\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9971336976\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<div id=\"mwtad2167698895\" class=\"gas_fallback-ad_309748-ad_309691-placement_360588\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3906789406\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">What Rokarolla Can Steal and Control<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Banking and cryptocurrency logins<\/strong> through convincing screen overlays.<\/li>\n\n\n<li><strong>Typed information<\/strong> through keylogging and Accessibility monitoring.<\/li>\n\n\n<li><strong>The device PIN or unlock pattern<\/strong> observed during normal phone use.<\/li>\n\n\n<li><strong>SMS messages and one-time codes<\/strong> used for account verification.<\/li>\n\n\n<li><strong>WhatsApp contacts and call information<\/strong> useful for impersonation and fraud.<\/li>\n\n\n<li><strong>Screen content and button presses<\/strong> across other applications.<\/li>\n\n\n<li><strong>Phone and messaging functions<\/strong> after becoming a default handler.<\/li>\n\n\n<li><strong>Security settings<\/strong> that can be changed to reduce warnings or obstruct removal.<\/li>\n<\/ul>\n\n\n\n<div id=\"mwtad373561051\" class=\"gas_fallback-ad_318930-ad_309691-placement_360589\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3818335085\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Warning Signs of a Rokarolla Infection<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An unofficial TikTok 18+ app was installed from a website or message.<\/li>\n\n\n<li>Android requested permission to install unknown apps.<\/li>\n\n\n<li>The app demanded Accessibility access or full control of the screen.<\/li>\n\n\n<li>A fake Play Protect scan appeared inside the app.<\/li>\n\n\n<li>The app icon disappeared after permissions were granted.<\/li>\n\n\n<li>Banking apps show unusual login screens or repeated errors.<\/li>\n\n\n<li>SMS messages, calls or security notifications behave unexpectedly.<\/li>\n\n\n<li>Play Protect is disabled without your action.<\/li>\n\n\n<li>The phone wakes, stays active, mutes itself or drains its battery abnormally.<\/li>\n<\/ul>\n\n\n\n<div id=\"mwtad2261453364\" class=\"gas_fallback-ad_381388-ad_309691-placement_381390\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3191649120\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">What to Do If Rokarolla Is Installed<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Isolate the phone<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Turn on airplane mode, then disable Wi-Fi and Bluetooth. Do not open banking, email, password-manager or cryptocurrency apps. Avoid typing replacement passwords on the suspected phone.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Revoke the permissions that protect the malware<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open Android Settings and check Accessibility, Device admin apps, Notification access, Install unknown apps and Default apps. Remove the suspicious app&#8217;s access wherever possible. Replace it as the default SMS or phone app before uninstalling.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Disable its Accessibility service.<\/li>\n\n\n<li>Remove device-administrator privileges.<\/li>\n\n\n<li>Revoke notification, SMS, phone, contacts and storage permissions.<\/li>\n\n\n<li>Change default SMS and phone handlers back to trusted system apps.<\/li>\n\n\n<li>Disable permission to install unknown applications.<\/li>\n\n\n<li>Re-enable Google Play Protect if it was turned off.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Restart in Safe Mode and uninstall the fake app<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Safe Mode temporarily prevents most third-party apps from running. Use it if the uninstall button is blocked or the malicious screen keeps returning. Find the fake TikTok 18+ application in Settings and uninstall it.<\/p><div id=\"mwtad4289444546\" class=\"gas_fallback-ad_360567-ad_309691-placement_360771\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6224621518\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Scan the Android device<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After removing the suspicious app, use a reputable mobile security scanner to check for additional components and unsafe applications.<\/p>\n\n\n<p>Malwarebytes for Android automatically detects and removes dangerous threats like malware and ransomware so you don&#8217;t have to worry about your most-used device being compromised. Aggressive detection of adware and potentially unwanted programs keeps your Android phone or tablet running smooth.<\/p>\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p class=\"mwt_quick_overview\">Download Malwarebytes for Android.<\/p>\n<p>You can download <strong>Malwarebytes for Android<\/strong> by clicking the link below.<\/p>\n<figure><img decoding=\"async\" class=\"alignleft size-full wp-image-81150 mwt_product_icon_logo\" title=\"Malwarebytes Icon\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2018\/06\/Malwarebytes-LOGO.png\" alt=\"Malwarebytes Logo\" width=\"40\" height=\"40\"\/><\/figure><div class=\"mwt_download_box\"><strong><a href=\"https:\/\/play.google.com\/store\/apps\/details?id=org.malwarebytes.antimalware&#038;hl=en\" target=\"_blank\" rel=\"noopener noreferrer\">MALWAREBYTES FOR ANDROID DOWNLOAD LINK<\/a><\/strong><br \/><em>(The above link will open a new page from where you can download Malwarebytes for Android)<\/em><\/div>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Install Malwarebytes for Android on your phone.<\/p>\n<p>In the Google Play Store, tap &#8220;<strong>Install<\/strong>&#8221; to install Malwarebytes for Android on your device.<\/p>\n<figure><img decoding=\"async\" class=\"alignnone size-full wp-image-106940\" title=\"Tap Install to install Malwarebytes for Android\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Google-Play-App.jpg\" alt=\"Tap Install to install Malwarebytes for Android\" width=\"292\" height=\"580\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Google-Play-App.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Google-Play-App-151x300.jpg 151w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><\/figure><p><\/p>\n<p>When the installation process has finished, tap &#8220;<strong>Open<\/strong>&#8221; to begin using Malwarebytes for Android. You can also open Malwarebytes by tapping on its icon in your phone menu or home screen.<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-106941\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Open-App.jpg\" alt=\"Malwarebytes for Android - Open App\" width=\"292\" height=\"578\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Open-App.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Open-App-152x300.jpg 152w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Follow the on-screen prompts to complete the setup process<\/p>\n<p>When Malwarebytes will open, you will see the <em>Malwarebytes Setup Wizard<\/em> which will guide you through a series of permissions and other setup options.<br \/>This is the first of two screens that explain the difference between the Premium and Free versions. Swipe this screen to continue.<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-106944\" title=\"Malwarebytes Setup Screen 1\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-1.jpg\" alt=\"Malwarebytes Setup Screen 1\" width=\"292\" height=\"577\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-1.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-1-152x300.jpg 152w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><br \/>Tap on &#8220;<strong>Got it<\/strong>&#8221; to proceed to the next step.<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-106945\" title=\"Malwarebytes Setup Screen 2\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-2.jpg\" alt=\"Malwarebytes Setup Screen 2\" width=\"292\" height=\"580\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-2.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-2-151x300.jpg 151w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><br \/>Malwarebytes for Android will now ask for a set of permissions that are required to scan your device and protect it from malware. Tap on &#8220;<strong>Give permission<\/strong>&#8221; to continue.<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-106946\" title=\"Malwarebytes Setup Screen 3\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-3.jpg\" alt=\"Malwarebytes Setup Screen 3\" width=\"292\" height=\"570\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-3.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-3-154x300.jpg 154w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><br \/>Tap on &#8220;Allow&#8221; to permit Malwarebytes to access the files on your phone.<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-106947\" title=\"Malwarebytes Setup Screen 4\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-7.jpg\" alt=\"Malwarebytes Setup Screen 4\" width=\"292\" height=\"573\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-7.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Setup-Wizard-7-153x300.jpg 153w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Update database and run a scan with Malwarebytes for Android<\/p>\n<p>You will now be prompted to update the Malwarebytes database and run a full system scan.<\/p>\n<figure><img decoding=\"async\" class=\"alignnone size-full wp-image-106939\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Fix-Issues.jpg\" alt=\"Malwarebytes fix issue\" width=\"292\" height=\"579\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Fix-Issues.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Fix-Issues-151x300.jpg 151w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><\/figure><p><\/p>\n<p>Click on &#8220;<strong>Update database<\/strong>&#8221; to update the Malwarebytes for Android definitions to the latest version, then click on &#8220;<strong>Run full scan<\/strong>&#8221; to perform a system scan.<\/p>\n<figure><img decoding=\"async\" class=\"alignnone size-full wp-image-106948\" title=\"Update database and run Malwarebytes scan\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Update-Run-Scan.jpg\" alt=\"Update database and run Malwarebytes scan on phone\" width=\"291\" height=\"575\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Update-Run-Scan.jpg 291w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Update-Run-Scan-152x300.jpg 152w\" sizes=\"(max-width: 291px) 100vw, 291px\" \/><\/figure><p><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Wait for the Malwarebytes scan to complete.<\/p>\n<p>Malwarebytes will now start scanning your phone for adware and other malicious apps. This process can take a few minutes, so we suggest you do something else and periodically check on the status of the scan to see when it is finished.<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-106943\" title=\"Malwarebytes scanning phone for malware\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Scanning-for-Malware.jpg\" alt=\"Malwarebytes scanning Android for Vmalware\" width=\"292\" height=\"579\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Scanning-for-Malware.jpg 292w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Scanning-for-Malware-151x300.jpg 151w\" sizes=\"(max-width: 292px) 100vw, 292px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Click on &#8220;Remove Selected&#8221;.<\/p>\n<p>When the scan has been completed, you will be presented with a screen showing the malware infections that Malwarebytes for Android has detected. To remove the malicious apps that Malwarebytes has found, tap on the &#8220;<strong>Remove Selected<\/strong>&#8221; button.<br \/><img decoding=\"async\" class=\"alignnone size-full wp-image-106942\" title=\"Tap on the Remove button to get rid of malware\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Removing-Malware.jpg\" alt=\"Remove malware from your phone\" width=\"760\" height=\"600\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Removing-Malware.jpg 760w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2020\/05\/Malwarebytes-for-Android-Removing-Malware-300x237.jpg 300w\" sizes=\"(max-width: 760px) 100vw, 760px\" \/><\/p>\n<\/li>\n\n\n\n<li>\n<p class=\"mwt_quick_overview\">Restart your phone.<\/p>\n<p>Malwarebytes for Android will now remove all the malicious apps that it has found. To complete the malware removal process, Malwarebytes may ask you to restart your device.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Secure important accounts from a clean device<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use another trusted phone or computer. Contact the bank first if financial apps were used after infection, then change credentials for email, Google, social media, cryptocurrency exchanges and any account whose password was entered on the phone.<\/p><div id=\"mwtad1610432062\" class=\"gas_fallback-ad_360571-ad_309691-placement_360772\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5867729999\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Tell the bank that Android banking malware may have intercepted credentials and one-time codes.<\/li>\n\n\n<li>Block or replace payment cards if unauthorized activity is possible.<\/li>\n\n\n<li>Reset email and Google account passwords and revoke all active sessions.<\/li>\n\n\n<li>Regenerate backup codes and review multi-factor authentication devices.<\/li>\n\n\n<li>Move cryptocurrency assets only with guidance from the legitimate wallet or exchange provider.<\/li>\n\n\n<li>Warn contacts if suspicious SMS or WhatsApp messages were sent from your accounts.<\/li>\n\n\n<li>Ask the mobile carrier to add account protections against SIM-swap attempts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Factory-reset the phone if confidence cannot be restored<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A factory reset is the safest option when removal fails, powerful permissions return, unknown apps remain or financial loss has occurred. Back up only personal photos and documents, not apps or full-device settings that might restore the threat.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After the reset, install system updates, download apps only from Google Play and restore them individually. Do not reinstall the TikTok 18+ APK or any file obtained from the same website or message.<\/p>\n\n\n\n<div id=\"mwtad3324564818\" class=\"gas_fallback-ad_381392-ad_309691-placement_381395\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"2944237110\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">How to Avoid Fake Android Apps<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Install apps only from Google Play or the verified developer&#8217;s official store listing.<\/li>\n\n\n<li>Do not trust websites offering adult, premium or modified versions of popular apps.<\/li>\n\n\n<li>Treat Accessibility requests from video, shopping or entertainment apps as a major warning.<\/li>\n\n\n<li>Keep Play Protect and Android security updates enabled.<\/li>\n\n\n<li>Read permission prompts instead of approving them automatically.<\/li>\n\n\n<li>Use a password manager, which can help expose fake overlays or unrelated login domains.<\/li>\n\n\n<li>Never install an APK because a stranger, advertisement or social-media post says it unlocks hidden content.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is TikTok 18+ a real TikTok application?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The application used in this campaign is fake. It is not an official TikTok release and is used to distribute the Rokarolla banking trojan.<\/p><div id=\"mwtad3299831968\" class=\"gas_fallback-ad_360576-ad_309691-placement_360773\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6594472392\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Can Rokarolla steal a banking password?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. It can display fake overlays above financial apps, monitor typed information and abuse Accessibility access to observe or control interactions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can it read text messages and one-time codes?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Its SMS capabilities can expose verification codes and help attackers approve account access or transactions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Will uninstalling the app fix everything?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Uninstalling stops the known application, but credentials already stolen remain compromised. Scan the phone, review permissions and secure every sensitive account from a clean device. Reset the phone if you cannot be confident it is clean.<\/p><div id=\"mwtad1734773558\" class=\"gas_fallback-ad_360583-ad_309691-placement_360774\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"8849826992\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Is reading a TikTok message enough to infect Android?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Normally, no. The victim generally has to download and install the malicious APK, allow installation from an unknown source and grant powerful permissions. Do not test the file.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Bottom Line<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Rokarolla is a serious Android banking trojan hidden behind a fake TikTok 18+ app.<\/strong> Its Accessibility abuse, overlays, SMS interception and remote-control features can expose both the phone and the accounts used on it. Isolate the device, remove the app and secure financial and identity accounts from clean hardware.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Rokarolla is an Android banking trojan spread through a fake TikTok 18+ app. It steals logins, OTP codes and device access. Learn how to remove it.<\/p>\n","protected":false},"author":50,"featured_media":398639,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ai_generated_summary":"","footnotes":""},"categories":[2836,2728],"tags":[],"class_list":["post-398648","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware-removal-and-popup-scam-alerts","category-trojans","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/398648","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=398648"}],"version-history":[{"count":1,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/398648\/revisions"}],"predecessor-version":[{"id":398650,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/398648\/revisions\/398650"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/398639"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=398648"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=398648"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=398648"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}