FvncBot Android Malware Steals Keystrokes and Injects Harmful Payloads
An Android banking trojan named FvncBot has been identified as a sophisticated threat to mobile banking users in Poland. Initially discovered by Intel 471 on Tue, Nov 25, 2025, this malware masquerades as a security application from mBank, a major Polish…
An Android banking trojan named FvncBot has been identified as a sophisticated threat to mobile banking users in Poland. Initially discovered by Intel 471 on Tue, Nov 25, 2025, this malware masquerades as a security application from mBank, a major Polish banking institution.
Novel Malware with Advanced Capabilities
FvncBot represents a new strain of Android malware, distinct from previous threats as it does not rely on leaked source code from other banking trojans. Named after its application package identifier "com.fvnc.app," the malware shows significant technical sophistication.
The infection process involves a two-stage approach. A loader application prompts users to install a seemingly legitimate "Play component" for security purposes. Once activated, the loader deploys the FvncBot payload, stored unencrypted in the application's assets.
The malware uses Android's accessibility services to perform keylogging, capturing sensitive data such as passwords and one-time password codes. Captured data is stored in a buffer that holds up to 1,000 items before being transmitted via HTTP requests.
An Android banking trojan named FvncBot has been identified as a sophisticated threat to mobile banking users in Poland.
FvncBot executes web-injection attacks by displaying phishing pages over legitimate banking applications. These pages, loaded in WebView components, use custom JavaScript interfaces to capture credentials. The list of targeted applications and phishing URLs is retrieved from a command-and-control server and stored locally on infected devices.
The malware allows attackers to remotely control infected devices through WebSocket connections, enabling actions such as launching applications, entering data, and manipulating the clipboard. To conceal fraudulent activities, it can lock devices, mute audio, and display black overlays.
Screen streaming is implemented using the MediaProjection API with H.264 video encoding for efficient bandwidth use. Additionally, FvncBot features a "text mode" that reconstructs device screens by analyzing UI elements through accessibility services, bypassing screenshot prevention measures.
Based on reporting by GBHackers.