BlackRock banking Trojan targets Android apps
Trojan steals login credentials and credit card information and has targeted more than 300 apps

Researchers at ThreatFabric have released a report detailing their findings on BlackRock, the Android banking Trojan. Discovered in May, BlackRock steals login credentials and credit card information and has targeted 337 financial, communication, dating and social networking apps.
According to ThreatFabric, BlackRock poses as a fake Google Update and requests accessibility privileges. Once the Trojan gets the needed privileges, it grants itself additional permissions so it can function without requiring any further interaction with the device’s user.
BlackRock can collect device information, perform overlay attacks, act as a keylogger, push system notifications to the C2 server, curb antivirus use and even prevent uninstallation.
ThreatFabric says BlackRock is based on Xerxes banking malware code, which was a strain of the LokiBot Android banking Trojan discovered in 2019.
LokiBot was observed as rented malware between 2016 and 2017. The Trojan’s source code was later leaked.
In 2018, MysteryBot, which included upgrades to the LokiBot Trojan so it worked on newer Android devices, was observed to be active. Parasite, MysteryBot’s successor, was also based on LokiBot, though it ultimately disappeared from the threat landscape, and Xeres replaced it in 2019. Fast-forward to May 2020, and BlackRock emerged.
“After investigation, it became clear that this newcomer is derived from the code of the Xerxes banking malware, which itself is a strain of the LokiBot Android banking Trojan. The source code of the Xerxes malware was made public by its author around May 2019, which means that it is accessible to any threat actor,” the report says.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
“When source code of malware is leaked or made publicly accessible it is pretty common to see the threat landscape being supplemented with new malware variants or families based on the said code,” the report continued.
Thus far, BlackRock’s targets for credential theft have included the following apps:
- Gmail
- Microsoft Outlook
- Google Play
- Uber
- Amazon
- eBay
- Netflix
- Cash App
- Coinbase
- Binance
It’s also targeted various banking apps in an effort to steal credentials, including:
- Barclays
- Santander
- Royal Bank of Scotland
- Lloyds
- ING
- Wells Fargo.
To steal credit card information, BlackRock has targeted a wide range of apps, including:
-
Bigger salaries, more burnout: Is the CISO role in crisis?
In-depth CISOs are more stressed than ever before – but why is this and what can be done?
By Kate O'Flaherty Published
-
Cheap cyber crime kits can be bought on the dark web for less than $25
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott Published
-
CronRat Magecart malware uses 31st February date to remain undetected
News The malware allows for server-side payment skimming that bypasses browser security
By Rene Millman Published
-
Mekotio trojan continues to spread despite its operators’ arrests
News Hackers have used it in 100 more attacks since arrests
By Rene Millman Published
-
“Trojan Source” hides flaws in source code from humans
News Organizations urged to take action to combat the new threat that could result in SolarWinds-style attacks
By Rene Millman Published
-
What is Emotet?
In-depth A deep dive into one of the most infamous and prolific strains of malware
By Praharsha Anand Last updated
-
Fake AnyDesk Google ads deliver malware
News Malware pushed through Google search results
By Rene Millman Published
-
Hackers use open source Microsoft dev platform to deliver trojans
News Microsoft's Build Engine is being used to deploy Remcos password-stealing malware
By Rene Millman Published
-
Android users told to be on high alert after Cerberus banking Trojan leaks to the dark web
News The source code for the authenticator-breaking malware is available for free on underground forums
By Sabina Weston Published
-
Qbot malware surges into the top-ten most common business threats
News An evolved form of the banking Trojan was distributed by number one-ranking Emotet in a campaign that hit 5% of businesses globally
By Keumars Afifi-Sabet Published