The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Researchers identified hundreds of malicious Android app samples linked to a 2023 campaign targeting Iranian mobile-banking users—but that figure is an app count, not a count of victims or compromised accounts. Sophos first reported four apps impersonating Iranian financial institutions; Zimperium later identified 245 additional apps associated with the same actors.
What the 2023 campaign involved
Sophos X-Ops reported four credential-stealing Android apps impersonating Bank Mellat, Bank Saderat, Resalat Bank and the Central Bank of Iran. The researchers said the apps were available from December 2022 through May 2023. They collected online-banking credentials and payment-card details, could hide their icons, and intercepted incoming SMS messages that some banks used for multifactor authentication. Sophos’s report
In a follow-up published November 28, 2023, Zimperium reported 245 additional app samples associated with the same actors, beyond the 40 apps counted in its account of the initial research. It also said 28 of those additional samples were not detected by the industry when they were uploaded to VirusTotal. That is a point-in-time scanner result, not a current detection rate. Neither report establishes how many people installed the apps, how many devices were infected, or whether users lost money. Zimperium’s follow-up
How the original apps stole banking information
In the samples Sophos examined, the app asked for permission to read SMS messages, presenting a financial-transaction explanation. It then showed a counterfeit bank login page. After a user entered credentials, the app sent them to a command-and-control server, requested the user’s date of birth, and displayed a misleading notice that the account would be activated within 24 hours. That delay could give an attacker time to use or sell stolen information. Sophos’s technical analysis
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- THE EVERYTHING TRACKER: Protect lost or stolen stuff and make family life easier. Attach to everyday things like keys, water bottles, or bags
- STAY SAFE WITH SOS: Discreetly trigger an SOS alert to your loved ones in unsafe situations
- FIND YOUR THINGS: Ring your misplaced Tile, or track it down in the free app
- FIND YOUR PHONE: Phone hiding under a cushion? Use your Tile to make it ring — even when silenced
- USE WITH LIFE360: Add your Tiles to Life360 — a top family connection and safety app – to see everything and everyone on the same map
Sophos found that the observed samples used Firebase Cloud Messaging as a command channel. Some were signed with a certificate previously used by a Malaysian IT firm for benign Google Play apps. Sophos said it was unclear how the campaign’s operators obtained that certificate, so the finding does not prove it was stolen. Sophos’s analysis of the samples
What later variants added
Zimperium described two further iterations of the malware, with broader target checks and additional capabilities. In reported later samples, Android Accessibility services could help the malware monitor foreground apps, display phishing pages in WebViews, automate permission grants, click interface elements and make removal more difficult. These are capabilities reported across later variants; the evidence does not show that every sample had all of them. Zimperium’s variant analysis
Rank #2
- Works with Apple Find My: Just use the pre-installed Find My app and add SmartTrack Link to the Items tab. You can then locate it anywhere in the world using Apple's network of millions of devices. Note: Apple Find My features only work if used with an iOS, iPadOS, or macOS device.
- Find Your Phone in Silent Mode: Avoid tearing up your apartment searching for your phone. With just a double tap, your phone rings—even in silent mode.
- Free Left-Behind Alerts: Avoid losing your belongings in the first place with instant left-behind alerts via the eufy Security app—with no added fee.
- Always Linked to Your Item: If something's lost, you're always connected via Link's QR code. A person who finds your item can scan and see only the contact information you share.
- Share with Friends and Family: With the eufy Security app you can let others know the location of your items too.
Which apps were targeted—and what the checks mean
The four original apps directly impersonated the four named financial institutions. Sophos also found a hardcoded list of other banking, payment and cryptocurrency apps that the malware checked for on a device. In the samples it observed, the malware transmitted the results of those presence checks but took no further action against the listed apps. Finding an app on a device therefore did not establish that the app or its account was attacked or compromised. Sophos’s analysis
Zimperium reported that later samples broadened target checks, including checks for cryptocurrency wallets. Its researchers assessed some wallets as likely future targets as the campaign developed. That was a forecast, not evidence that those wallets were subsequently attacked. Zimperium’s report
Recommended Free Tools
Rank #3
- REDESIGNED TO DO MORE: The redesigned Galaxy SmartTag2 is made so you can keep calm and keep track¹; Its design makes it easy for you to tag and carry your belongings
- EASY TO USE: It's IP67-rated water- and dust-resistant², activates your compatible IoT devices³ and stays powered for up to 500 days⁴ or even up to 40% more on Power Saving Mode⁵
- RELAX, YOU'VE GOT IT TAGGED: Simply register a new Galaxy SmartTag2 and get started right away with SmartThings Find; With its intuitive tracking experience, you now have a way to keep track of things you love right in the palm of your hand¹
- SEARCH NEAR WHEN IT'S NOT FAR: Lose something? Switch on Search Nearby⁶ and get instructions to your item's location via Compass View⁷; If you still don't see it, just ring your Galaxy SmartTag2 to have it send out an audible signal
- TAGGED & TRENDY: Cover your Galaxy SmartTag2 with a colorful Silicone Case for protection and a smooth touch – or a Rugged Case with a non-slip pattern on the side and additional bumper on the bottom⁸; Both have a carabiner ring attachment
Are the malicious banking apps still active?
The available reporting dates the original apps’ availability to December 2022 through May 2023. It does not establish that those same samples remain available or active now, so it would be misleading to say they are still circulating—or that they have all disappeared. The 2023 sample counts also do not indicate how many users were affected.
Iran-focused Android threats have been reported since then, but a later campaign is not automatically the same operation. Cyble reported that a separate campaign called deVixor had been active since October 2025. In a report dated January 13, 2026, its research lab said it had analyzed more than 700 deVixor samples and described SMS harvesting, credential theft, remote-control and ransomware capabilities. That count concerns deVixor samples, not the 2023 banking apps or their victims; the report does not establish that deVixor shares their operators. Cyble’s deVixor report
Rank #4
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
How to check whether an Android banking app is genuine
- Start from the bank’s official website or a verified app-store listing reached from that site. Do not install a banking app through a link in an unexpected text, email or other untrusted message.
- Check the developer name and app details against the bank’s own instructions. A familiar bank name or logo alone does not prove an app is authentic.
- Be cautious if an app asks for permissions that do not make sense for its stated purpose. In this campaign, an SMS-reading request was presented as a way to handle financial transactions, but the apps used that access to intercept messages.
- If you are uncertain, contact the bank through a phone number or support channel obtained independently from its official website—not through the suspicious message or app.
Sophos advises Android users to avoid installing apps from links in emails, text messages or other communications from untrusted sources, and recommends mobile threat-detection software. It specifically names Sophos Intercept X for mobile; that mention is Sophos’s advice, not evidence that a particular product is available in every country or a guaranteed fix for an infection. Sophos’s user guidance
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can an Android banking trojan read SMS codes?
It can if it obtains the relevant SMS permission or uses other capabilities that provide access to messages. Sophos reported that its observed samples intercepted incoming SMS messages, which some banks used for multifactor authentication. An SMS code can therefore be exposed on a device running a malicious app with that access; multifactor authentication does not make a stolen login harmless if the second factor is intercepted too.
Quick Recap
Best Value
- Works with iOS & Android Systems - Compatible with Apple Find My and Android Find Hub, this Bluetooth tracker lets you locate items directly from your phone. Easy pairing and reliable connection let you start tracking in minutes, no tech skills required (Note: Cannot pair with iOS and Android devices simultaneously.)
- Find Items Fast with Loud Ringing - Misplaced something nearby? Tap your phone to trigger a loud 80dB ring and locate your items within a 40m range. No guessing, no searching, just quick results when you are in a hurry or heading out the door
- Certified Security with Full Privacy Protection - Built with Apple MFi and Google GMS certification, this item tracker follows strict security standards. Location data is encrypted and anonymized, giving you reliable tracking without sacrificing personal privacy
- Premium Fabric Finish, Built for Daily Use - Featuring a refined fabric-textured exterior, this tracker combines durability with style. IP65 waterproof and drop resistant, it is designed to handle everyday splashes, bumps, and outdoor use with ease
- Share Access with People You Trust - Easily share your tracker with family or friends. iOS supports up to 5 shared users, Android supports up to 10. Everyone can help locate shared items while you stay in full control of permissions
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
