Xenomorph Android Banking Trojan Returns with a New and More Powerful Variant


Level 15
Thread author
Top Poster
Mar 13, 2022
A new variant of the Android banking trojan named Xenomorph has surfaced in the wild, the latest findings from ThreatFabric reveal.

Named "Xenomorph 3rd generation" by the Hadoken Security Group, the threat actor behind the operation, the updated version comes with new features that allow it to perform financial fraud in a seamless manner.

"This new version of the malware adds many new capabilities to an already feature-rich Android banker, most notably the introduction of a very extensive runtime engine powered by Accessibility services, which is used by actors to implement a complete ATS framework," the Dutch security firm said in a report shared with The Hacker News.

Xenomorph first came to light a year ago in February 2022, when it was found to target 56 European banks through dropper apps published on the Google Play Store.


Level 71
Top Poster
Content Creator
Oct 9, 2016
Just don't perform financial transactions using the android phone.

If you really need to use a phone, then use a dedicated phone for financial transactions. Do NOT install other apps except your banking app.


Staff Member
Malware Hunter
Jul 27, 2015
the samples identified by ThreatFabric featured configurations with Target lists made of more than 400 banking and financial institutions, including several cryptocurrency wallets, with an increase of more than 6 times with comparison to its previous variants, including financial institutions from all continents.

In addition, after discovering some samples belonging to this new variant, our researchers also discovered the website dedicated to the advertisement of this Android banker, indicating clear intentions of entering the MaaS landscape, and start large scale distribution.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.