A newly discovered Android banking trojan known as OverlayPhantom is raising concerns among cybersecurity researchers after evidence revealed that the malware is actively targeting banking, financial, and cryptocurrency users across multiple Western countries.  The malware campaign, uncovered by Cyble Research and Intelligence Labs (CRIL), demonstrates how modern threat actor groups are combining social engineering, remote device control, phishing overlays, and real-time surveillance capabilities into a single malicious framework.  According to researchers, OverlayPhantom has been active since May 2025 and is currently targeting more than 180 applications across 10 countries, including the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain, and the United Kingdom. The Android banking trojan is being distributed via malicious URLs that impersonate trusted applications, attempting to trick users into installing infected APK files. 

OverlayPhantom Uses Trusted Brands to Infect Victims 

The initial OverlayPhantom sample was discovered on a malicious domain distributing a fake version of ID Austria, the Austrian government’s official digital identity application. Researchers noted that the use of a government-themed lure increased the effectiveness of the malware campaign because victims are more likely to trust requests tied to identity verification or public services. A second sample linked to the same threat actor impersonated TikTok and appeared to focus on users in Spain. The shift from a government application to a mainstream social media platform suggested that the operators behind OverlayPhantom are deliberately broadening their infection strategies to target both institutional trust and consumer familiarity. CRIL researchers stated that the Android banking trojan employs a two-stage infection process. Victims initially download a dropper application that displays what appears to be a legitimate Google Play update screen. The fake update interface is designed to reduce suspicion and persuade users to continue the installation process. The malware also includes a guided tutorial that instructs victims on how to enable Android Accessibility Service permissions — a critical step that grants the threat actor elevated access to the infected device.

Android Banking Trojan Abuses Accessibility Services

Once installed, OverlayPhantom disguises itself as “Google Play Services,” making the malicious application harder for users to detect or remove. Researchers said the Android banking trojan abuses Android’s Accessibility Service to monitor user activity, intercept inputs, simulate gestures, and maintain persistent device control.  The malware establishes communication with its command-and-control (C&C) infrastructure through the IP address hxxps://199.217[.]99[.]122 using three separate ports dedicated to different tasks: 

• Port 9092 handles device status reporting
• Port 9091 is used for command-and-control communication
• Port 9090 supports screen streaming functionality

Researchers found that OverlayPhantom can execute more than 30 remote commands issued by the threat actor. These commands allow attackers to perform taps, swipes, long presses, open recent apps, manipulate clipboard contents, increase or lower volume, lock screens, display fake notifications, and even launch fraudulent overlay windows designed to capture passwords or PINs. The Android banking trojan also supports commands such as startStreamJpeg and stopStreamJpeg, enabling remote screen streaming sessions.

OverlayPhantom Conducts Advanced Overlay Attacks 

One of the most dangerous features of OverlayPhantom is its use of embedded HTML phishing overlays. The malware continuously monitors which applications are running in the foreground and compares them against a hardcoded target list embedded within the APK. When a targeted banking or cryptocurrency application is opened, the Android banking trojan launches a counterfeit login page through an embedded WebView. Researchers said these phishing interfaces are carefully designed to visually match legitimate financial applications, making them difficult for victims to distinguish from the real apps. From the user’s perspective, the fake login screen appears authentic. However, any credentials entered into the overlay are immediately harvested and transmitted back to the threat actor’s infrastructure. CRIL researchers noted that OverlayPhantom specifically targets banking, finance, and cryptocurrency platforms, reflecting a financially motivated operation focused on large-scale fraud.

Real-Time Screen Streaming Expands Threat Actor Capabilities 

OverlayPhantom also includes a built-in real-time screen streaming mechanism powered by Android’s MediaProjection API. When activated, the malware captures screen activity through a VirtualDisplay instance named “jpeg-stream” and continuously transmits compressed JPEG images back to the C&C server over port 9090.  The captured output is resized to a fixed width of 540 pixels while preserving the original aspect ratio of the victim’s device. Researchers explained that JPEG compression helps reduce bandwidth usage while still giving the threat actor near real-time visibility into user activity.  The malware also contains resilience mechanisms to maintain streaming sessions. If the connection drops or no image frames are available, OverlayPhantom pauses briefly before attempting reconnection. Once retry limits are exceeded, the malware disables the streaming session to avoid endless reconnection loops. According to researchers, the operator can terminate screen streaming at any moment by issuing the stopStreamJpeg command.

Researchers Warn OverlayPhantom Threat May Expand 

Cybersecurity researchers described OverlayPhantom as a “mature and methodically engineered Android banking trojan” due to its combination of phishing overlays, Accessibility Service abuse, multi-port communication infrastructure, and remote device manipulation features. While many of the individual techniques used by the malware are not entirely new, researchers warned that the coordinated integration of government impersonation, consumer application lures, credential theft overlays, and real-time surveillance capabilities makes this threat actor particularly dangerous. The report concluded that the operational scale of OverlayPhantom — including its targeting of more than 180 applications across multiple countries — indicates that the Android banking trojan campaign may continue expanding in scope and sophistication in the coming months. Security experts advised organizations and individuals in affected regions to treat OverlayPhantom as a high-priority threat due to its ability to silently harvest credentials, monitor device activity, and facilitate financial fraud without obvious signs of compromise.

A newly identified cyber campaign involving JanaWare ransomware is targeting users in Turkey, with researchers linking the activity to a customized version of the Adwind Remote Access Trojan (RAT). The findings come from an analysis by researchers at Acronis’ Threat Research Unit (TRU), who identified the threat cluster during an investigation into suspicious Java-based malware samples. According to the researchers, the JanaWare ransomware operation appears to have been active since at least 2020. Evidence from malware samples and infrastructure indicates that the campaign has continued into late 2025, suggesting sustained activity with limited visibility. The attack relies on a modified Adwind RAT that includes polymorphic capabilities. This allows the malware to change its structure across infections, making detection more difficult. Combined with code obfuscation, these techniques have likely contributed to the campaign remaining relatively unnoticed. Unlike large ransomware groups that focus on high-value enterprise targets, JanaWare ransomware appears to follow a different strategy. Observed ransom demands range between $200 and $400, pointing to a model that prioritizes volume over large individual payouts.

Phishing Identified as Primary Infection Vector

The JanaWare ransomware campaign primarily spreads through phishing emails. Victims are lured into clicking malicious links, which lead to the download of a Java archive file. In many observed cases, the payload is hosted on cloud storage platforms. Telemetry data reviewed by researchers shows a consistent attack chain. A phishing email is opened in Microsoft Outlook, followed by a browser session that downloads the malicious file. The file is then executed using Java, triggering the infection. [caption id="attachment_111347" align="aligncenter" width="761"] Image Source: Acronis’ Threat Research Unit (TRU)[/caption] User reports on public cybersecurity forums also describe similar incidents, supporting the assessment that phishing is the main entry point.

Geofencing Restricts Janaware Ransomware Attacks to Turkey

A key feature of the JanaWare ransomware is its use of geofencing. The malware is designed to execute only on systems that meet specific regional criteria linked to Turkey. It checks system language, locale settings, and external IP geolocation before proceeding. If the system does not match Turkish parameters, the malicious activity is halted. Researchers note that this approach likely serves both operational and defensive purposes. It allows attackers to focus on a specific region while reducing exposure to global security monitoring and automated analysis systems.

Obfuscation and Polymorphism Hinder Detection

The JanaWare ransomware incorporates multiple techniques to evade detection. Researchers identified the use of known obfuscation tools such as Stringer and Allatori, alongside custom methods that complicate analysis. The malware also includes a self-modifying component that alters its file structure during deployment. By adding random data to its Java archive, each instance generates a unique file hash, limiting the effectiveness of signature-based detection. In addition, the malware contains embedded configuration parameters that control its behavior. These include command-and-control server details, communication ports, and authentication values used during initial connections.

Security Controls Disabled Before Encryption Stage

Before encrypting files, the malware attempts to weaken system defenses. It executes commands to disable Microsoft Defender, suppress security alerts, and remove recovery mechanisms such as Volume Shadow Copies. It also interferes with Windows Update and scans for installed antivirus software. These steps reduce the likelihood of detection or recovery once the ransomware payload is activated. The encryption process is carried out by a secondary module delivered after the initial compromise. This module uses AES encryption and communicates with command-and-control infrastructure over the Tor network.

Turkish-Language Ransom Notes Signal Targeted Approach

After encryption, the malware drops ransom notes across affected systems. These notes are written in Turkish and instruct victims to contact the attackers through encrypted communication channels such as qTox or Tor-based websites. Researchers say the consistent use of Turkish-language content, combined with geofencing, indicates a deliberate focus on users in Turkey rather than a broad, global campaign. The JanaWare ransomware campaign highlights how targeted, lower-profile operations can persist over long periods without drawing significant attention. By focusing on home users and small businesses, and keeping ransom demands relatively low, the attackers appear to maintain a steady but less visible operation. Researchers caution that such localized campaigns may continue to operate alongside larger ransomware groups, adding another layer to the evolving threat landscape.