New Android Malware "Albiriox" Gives Hackers Complete Control of Your Device

A dangerous new Android malware called Albiriox has emerged, threatening mobile banking users worldwide with sophisticated remote control capabilities and fraud techniques. Security researchers are calling it one of the most advanced mobile banking trojans discovered in 2025.

What Makes Albiriox Dangerous?

Albiriox represents a new generation of Android banking malware that goes far beyond simple password theft. The malware is being sold as a Malware-as-a-Service (MaaS), meaning cybercriminals can rent access to this powerful tool for a monthly subscription fee ranging from $650 to $720.

Researchers at Cleafy first identified this threat in September 2025 during a private testing phase on underground cybercrime forums. By October, it became publicly available to any cybercriminal willing to pay the subscription fee. Analysis suggests Russian-speaking threat actors are behind the operation.

How Albiriox Takes Over Your Device

The malware uses a two-stage infection process designed to bypass security detection:

Stage 1: The Dropper Victims receive phishing messages via SMS containing links to fake websites. These sites impersonate legitimate services—early campaigns used fake Google Play Store pages and counterfeit retail apps like "Penny Market." When users download what they think is a legitimate app, they're actually installing a dropper application.

The dropper immediately displays a fake "System Update" screen and requests permission to install additional apps. This permission is critical because it allows the malware to install its main payload without further user interaction.

Stage 2: The Main Payload Once permission is granted, the dropper installs the full Albiriox malware. The malware uses advanced obfuscation techniques (including JSONPacker) to hide from antivirus software, making it extremely difficult for security tools to detect.

Core Attack Capabilities

Albiriox combines two powerful attack methods that make it particularly dangerous:

1. Remote Access and Control

The malware includes a VNC-based remote access module that allows attackers to see and control the victim's screen in real-time. This isn't just screen recording—attackers can:

• Tap, swipe, and type anywhere on the device

What makes this especially concerning is the malware's use of "AC VNC" (Accessibility-based VNC). This technique exploits Android's Accessibility Services to bypass security protections that normally prevent screen recording or screenshots in banking apps. Even apps with FLAG_SECURE protection—designed to block screen capture—can be monitored by Albiriox.

2. Overlay Attacks for Credential Theft

The second attack vector uses fake overlay screens that appear over legitimate banking apps. When you open your banking app, Albiriox can display a convincing phishing screen that looks identical to your bank's login page. Any credentials entered are sent directly to the attackers.

The malware contains a hardcoded list of over 400 targeted applications, including:

• Traditional banking apps from major financial institutions

This extensive target list indicates the malware is designed for global fraud operations across multiple financial sectors.

On-Device Fraud: A New Threat Model

Albiriox enables what security researchers call "On-Device Fraud" (ODF). Unlike traditional malware that simply steals credentials for later use, Albiriox allows attackers to conduct fraudulent transactions directly from the victim's device in real-time.

Here's why this is so dangerous:

Bypassing Security Measures: When attackers use the victim's own device to make transactions, they bypass many fraud detection systems. The transaction appears to come from the legitimate user's device, with the correct device fingerprint, location data, and session credentials.

Invisible to the Victim: The malware can display a black screen while attackers work in the background, or it can operate while the user is asleep. The victim may not discover the fraud until they check their account later.

Real Session Hijacking: Because attackers are operating within an already-authenticated session, they don't need to bypass two-factor authentication or other security measures—they're acting as the legitimate user.

Technical Architecture and Communication

Albiriox uses a surprisingly simple communication method: unencrypted TCP sockets. When the malware first activates, it sends a handshake to its command-and-control (C2) server containing:

• Hardware ID (HWID)

The malware maintains constant contact with the C2 server through a "ping/pong" heartbeat mechanism, allowing attackers to send commands at any time. The command set includes:

• Screen streaming and remote control

Real-World Attack Campaigns

Security researchers have already identified active Albiriox campaigns targeting real users. One early campaign specifically targeted Austrian victims using:

• German-language SMS phishing messages with shortened URLs

Later versions became more sophisticated, requiring victims to enter their phone numbers to receive download links via WhatsApp. All collected phone numbers were automatically sent to the attackers' Telegram bot, likely for future phishing campaigns or selling to other criminals.

Evasion Techniques

Albiriox developers have invested heavily in making their malware difficult to detect:

Golden Crypt Integration: The malware includes a custom builder that integrates with Golden Crypt, a third-party crypting service. This packaging makes the malware "Fully Undetectable" (FUD) to many antivirus engines.

Packing and Obfuscation: Multiple layers of code obfuscation hide the malware's true purpose from static analysis tools.

Legitimate-Looking Permissions: The malware disguises its permission requests as normal system updates or app installations, making users more likely to grant them.

Accessibility Service Abuse: By exploiting Accessibility Services—designed to help users with disabilities—the malware gains extensive control while appearing to use legitimate Android features.

How to Protect Yourself

Given the sophisticated nature of Albiriox, protection requires multiple layers of defense:

For Individual Users:

1. Only Download from Official Sources: Stick to the Google Play Store and avoid clicking links in SMS messages or social media posts that offer app downloads.

For Organizations:

1. Implement Mobile Threat Defense: Deploy enterprise mobile security solutions that can detect and block sophisticated threats like Albiriox.

The Broader Threat Landscape

Albiriox represents the latest evolution in Android banking malware. Several factors make it particularly concerning:

MaaS Business Model: By offering the malware as a subscription service, the creators have lowered the technical barrier for cybercriminals. Anyone willing to pay can now launch sophisticated mobile fraud campaigns without needing advanced technical skills.

Rapid Development: The malware transitioned from private beta to public release in just one month, and developers continue to add features. The overlay system, while currently generic, is being actively developed with app-specific phishing pages.

Professional Operation: The structured release, promotional videos, Telegram support channels, and custom builder tools indicate this is a well-organized criminal enterprise, not a hobbyist project.

Growing Target List: The 400+ targeted applications span multiple countries and financial sectors, suggesting the operation has global ambitions.

Looking Ahead

Security researchers expect Albiriox to evolve rapidly. The combination of remote access capabilities, overlay attacks, and advanced evasion techniques positions it to become a major threat in the mobile security landscape.

Financial institutions must adapt their fraud detection systems to account for ODF attacks where fraudulent transactions originate from the legitimate user's device. Traditional risk signals—like device fingerprinting and location data—become less reliable when attackers operate from within a hijacked session.

For Android users, the emergence of threats like Albiriox underscores the importance of security awareness and skepticism. If something seems too good to be true (like a surprise discount app requiring unusual permissions), it probably is.

Indicators of Compromise

If you suspect your device may be infected with Albiriox, watch for these warning signs:

• Unexpected permission requests, especially for Accessibility Services or installing apps

If you observe any of these signs, disconnect from the internet, avoid using banking apps, and contact a security professional or perform a factory reset (after backing up important, non-suspicious data).

Conclusion

Albiriox represents a significant escalation in mobile banking malware sophistication. Its combination of real-time remote control, accessibility-based screen capture, and on-device fraud capabilities makes it one of the most dangerous Android threats to emerge in 2025.

As this malware continues to evolve and more cybercriminals gain access through its subscription model, we can expect to see an increase in successful mobile fraud attacks. Both individuals and organizations must remain vigilant and implement comprehensive mobile security strategies to protect against this emerging threat.

The best defense remains a combination of technical security measures, user education, and healthy skepticism about unexpected app downloads and permission requests. In the world of mobile security, if something asks for permissions that seem excessive, trust your instincts and investigate before granting access.