New Android Banking Trojan Uses Hidden VNC to Gain Complete Remote Control Over Device
A newly identified Android banking trojan utilizes a hidden Virtual Network Computing (VNC) server to achieve full remote control over compromised devices, incorporating traditional overlay attacks.
A newly identified Android banking trojan utilizes a hidden Virtual Network Computing (VNC) server to achieve full remote control over compromised devices, incorporating traditional overlay attacks.
This malware was first detected in late September 2025 and is distributed through SMS-based phishing campaigns, misleading users into installing a counterfeit security application.
Once granted appropriate permissions, the trojan encrypts its payload to evade static detection and initiates a background VNC server that operates invisibly to the user.
Researchers at Cleafy identified the malware by observing abnormal network traffic from mobile users of several European banks. Upon installation, the trojan requests Accessibility and Device Administrator privileges, posing as a performance optimization tool.
Acquiring these permissions enables the interception of touch inputs, screen data capture, and the rendering of deceptive overlays on legitimate banking applications. Concurrently, the VNC module initiates a hidden framebuffer, allowing attackers to remotely view and control the device in real time.
This new variant marks a significant escalation by incorporating a headless VNC server, which allows attackers to navigate the device interface, enter passwords, and install additional payloads without relying solely on screen overlays.
The trojan utilizes multiple persistence tactics, including registering a broadcast receiver for BOOT_COMPLETED to restart the VNC service upon device reboot and integrating with the AccessibilityService to monitor screen state changes. It also disables Google Play Protect by exploiting hidden system APIs, preventing updates or scans that could disrupt its operations.
Researchers at Cleafy identified the malware by observing abnormal network traffic from mobile users of several European banks.
The infection process begins with an SMS message containing a link to download a trojanized APK named "BankGuard.apk." Upon installation, users are prompted to enable AccessibilityService and Device Administrator permissions.
The following code snippet demonstrates how the trojan invokes the Accessibility permission request:
Intent intent = new Intent(Settings.ACTION_ACCESSIBILITY_SETTINGS); context.startActivity(intent);
Once permissions are granted, the malware registers its AccessibilityService:
<service android: name=".StealthAccessibilityService" android: permission="android.permission.BIND_ACCESSIBILITY_SERVICE"> <intent-filter> <action android:name="android.accessibilityservice.AccessibilityService" /> </intent-filter> <meta-data android: name="android.accessibilityservice" android:resource="@xml/accessibilityservice_config" /> </service>
The trojan then silently launches its VNC server:
VNCServer vnc = new VNCServer(context); vnc.startServer(5900); // Standard VNC port
This server captures framebuffer data and listens for incoming remote control commands, allowing attackers to connect using standard VNC clients and gain complete interactive control over the device.
This method bypasses traditional overlay detection by avoiding UI injection, instead relying on genuine touch emulation through remote commands.
Based on reporting by Cyber Security News.