‘Godfather’ Malware Is Now Hijacking Banking Apps on Android

As malware evolves to be more sophisticated, seeing should not always equal believing. A new iteration of the “Godfather” malware found on Android is hijacking legitimate banking apps, making it increasingly difficult for users (and on-device protections) to detect.

An early version of Godfather utilized screen overlay attacks, which placed fraudulent HTML login screens on top of legitimate banking and crypto exchange apps, tricking users into entering credentials for their financial accounts. It was first detected on Android in 2021 and was estimated to target several hundred apps across more than a dozen countries.

The new threat, uncovered by security firm Zimperium, is Godfather’s virtualization, which allows the malware to create a complete virtual environment on your device rather than simply spoofing a login screen. It does so by installing a malicious “host” application, which scans for targeted financial apps and then downloads copies that can run in its virtual sandbox.

If you open one of those targeted apps, Godfather redirects you to the virtual version. You’ll see the real banking interface, but everything that happens within it can be intercepted and manipulated in real time. As Bleeping Computer notes, this includes harvesting account credentials, passwords, PINs, and capture responses from the bank’s back end. Further, the malware can control your device remotely, including initiating transfers and payments inside the banking or crypto app, even when you’re not using it.

This threat is severe not only because it is difficult for users to detect visually, but also because it can evade on-device security checks like root detection. Android protections see only the host app’s activity while the malware’s remains hidden.