Newly emergent Datzbro Android trojan spread in senior-targeted travel scams

Older adults in Australia, Canada, South Africa, Malaysia, Singapore, and the UK have been targeted with the novel Datzbro Android banking trojan through Facebook groups promoting trips and other activities for seniors, The Hacker News reports.

After posting artificial intelligence-generated content indicating purported activities for the elderly on Facebook groups, threat actors communicate with interested individuals on Facebook Messenger or WhatsApp to lure them into downloading an APK for illicit Android apps that injects either Datzbro or a Zombinder-based dropper, according to a ThreatFabric analysis.

Aside from enabling audio recording, photo capturing, and keylogging, Datzbro also features a schematic remote control mode allowing the exfiltration of on-screen information, while covertly pilfering lock screen PINs and Alipay- and WeChat-credentials, as well as cryptocurrency or bank codes through a semi-transparent black overlay.

"The discovery of Datzbro highlights the evolution of mobile threats targeting unsuspecting users through social engineering campaigns," said ThreatFabric researchers.