'It just vanished': Millions at risk as Android trojans use devious trick to 'magically' disappear once installed
The malware secretly captures logins and streams live device screens to attackers
by https://www.techradar.com/uk/author/wayne-williams · TechRadarNews By Wayne Williams published 7 May 2026
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter
- Four Android banking trojan campaigns target hundreds of finance and social apps
- Malware hides icons, blocks removal, and overlays fake banking login screens
- Live screen streaming lets attackers monitor activity and capture authentication steps
Security researchers have tracked four Android banking trojan campaigns that rely on deception, stealth, and disappearing app icons to stay hidden out of sight after installation.
Researchers at Zimperium say the campaigns, named RecruitRat, SaferRat, Astrinox, and Massiv, collectively targeted more than 800 banking, cryptocurrency, and social media apps.
The potential reach is vast because many commonly used apps have billions of downloads, although actual infections likely number in the millions rather than billions.
Article continues below
Increasingly complex installation techniques
The researchers note the attackers rely heavily on tricking users, rather than exploiting technical flaws alone. Victims are directed to fake websites disguised as job portals, streaming services, or software downloads that seem legitimate at first glance.
Some campaigns imitate recruitment platforms, pushing victims to download an app as part of a supposed hiring process, while others promise free access to premium streaming content. This leads users to sideload malicious software from unofficial sources.
Installation techniques have grown increasingly complex, with many attacks using multi-stage delivery methods that conceal the true malware payload inside another file.
One tactic involves mimicking official update screens, including layouts resembling the Google Play interface, to lower suspicion during installation.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors