{"id":9008,"date":"2025-12-07T10:03:31","date_gmt":"2025-12-07T10:03:31","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/07\/new-fvncbot-android-banking-attacking-users-to-log-keystrokes-and-inject-malicious-payloads\/"},"modified":"2025-12-07T10:03:31","modified_gmt":"2025-12-07T10:03:31","slug":"new-fvncbot-android-banking-attacking-users-to-log-keystrokes-and-inject-malicious-payloads","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/07\/new-fvncbot-android-banking-attacking-users-to-log-keystrokes-and-inject-malicious-payloads\/","title":{"rendered":"New FvncBot Android Banking Attacking Users to Log Keystrokes and Inject Malicious Payloads"},"content":{"rendered":"

New FvncBot Android Banking Attacking Users to Log Keystrokes and Inject Malicious Payloads
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A dangerous new Android banking malware named FvncBot w<\/span>as first observed on November 25, 2025. This\u00a0malicious tool\u00a0is designed to steal sensitive financial information by logging keystrokes, recording screens, and injecting fake login pages into banking apps.<\/p>\n

The malware<\/a> initially spreads through a fake application disguised as a security tool for\u00a0mBank, a popular Polish bank.<\/p>\n

\n
\"the
The accessibility service of the payload application<\/figcaption><\/figure>\n<\/div>\n

The app, named \u201cKlucz bezpiecze\u0144stwa mBank\u201d (Security Key mBank), acts as a \u201cloader\u201d. Once a user installs and opens this fake app, it secretly downloads and installs the primary FvncBot payload.<\/p>\n

To hide its activity, the malware uses a known obfuscation service called\u00a0apk0day, making it harder for security systems to detect.<\/p>\n

\"bot
Bot debug messages<\/em><\/figcaption><\/figure>\n

Researchers say FvncBot is different from other banking malware. Instead of reusing code from older threats<\/a> like Ermac or Hook, its code looks completely new.<\/p>\n

FvncBot is highly advanced and includes several powerful features to defraud victims:<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n
Feature<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Keylogging<\/td>\nAbuses Android Accessibility Services to capture every keystroke<\/a>, including passwords, PINs, and OTPs. Logs up to 1,000 events before exfiltrating via HTTP or WebSocket.<\/td>\n<\/tr>\n
Web-Inject Attacks<\/td>\nDisplays fake overlay windows on legitimate banking apps to trick users into entering credentials. Phishing pages received from command server.<\/td>\n<\/tr>\n
Screen Streaming<\/td>\nStreams device screen in real-time using H.264 video compression for efficient bandwidth usage and continuous monitoring.<\/td>\n<\/tr>\n
\nHVNC<\/a> (Hidden VNC)<\/td>\nEnables remote device control by creating JSON UI element representations. Allows attackers to navigate, swipe, click, and enter data.<\/td>\n<\/tr>\n
Remote Command Execution<\/td>\nUses WebSocket connection and Firebase Cloud Messaging (FCM) for near-real-time bidirectional communication with command servers.<\/td>\n<\/tr>\n
Device Manipulation<\/td>\nCapable of locking device, muting audio, displaying black overlays, launching applications, and entering arbitrary data into text fields.<\/td>\n<\/tr>\n
Code Obfuscation<\/td>\nObfuscated using apk0day crypting service operated by GoldenCrypt actor to evade detection<\/a> and security analysis.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

They can swipe, click, and even enter text to empty bank accounts while the phone appears locked or blacked out.<\/p>\n

The Intel471 discovery<\/a> of FvncBot underscores the importance of downloading apps only from official sources, such as the Google Play Store.<\/p>\n

\"\"
Log data collected from an overlay<\/em><\/figcaption><\/figure>\n

Users should be cautious of \u201csecurity updates\u201d or banking apps found on third-party websites or sent via direct messages, as these are common traps used to deliver this type of malware.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post New FvncBot Android Banking Attacking Users to Log Keystrokes and Inject Malicious Payloads<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

New FvncBot Android Banking Attacking Users to Log Keystrokes and Inject Malicious Payloads A dangerous new Android banking malware named FvncBot was first observed on November 25, 2025. This\u00a0malicious tool\u00a0is designed to steal sensitive financial information by logging keystrokes, recording screens, and injecting fake login pages into banking apps. The malware initially spreads through a […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[509,129,63,258],"tags":[130],"class_list":["post-9008","post","type-post","status-publish","format-standard","hentry","category-android","category-cyber-security","category-cyber-security-news","category-malware","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9008"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9008"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9008\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}