Trojan targets 180 banking and crypto apps

TLDR

A new Android banking trojan called OverlayPhantom is actively targeting around 180 banking, financial and crypto apps and can steal logins, PINs and take over accounts.

1. OverlayPhantom disguises itself as a system app and uses fake screens to capture credentials from more than 180 targeted apps across 10 countries.
2. The malware is especially dangerous for crypto users because it can bypass normal app security and drain irreversible crypto transfers once it has your credentials.
3. You can reduce risk by tightening Android security habits, avoiding sideloaded apps, using strong 2FA and keeping larger holdings on separate, more isolated wallets and devices.

Deep Dive

1. What OverlayPhantom Is Doing

Cybersecurity firm Cyble uncovered an Android malware campaign called OverlayPhantom that targets roughly 180 banking, financial services and crypto apps using overlay attacks, where fake screens mimic real apps to steal logins and PINs. A CoinsKid summary notes that this campaign spans both traditional finance and crypto platforms and has been running since at least May 2025.

According to Cybles report, the trojan spreads via malicious URLs that impersonate trusted apps like ID Austria and TikTok, then installs a dropper that later disguises itself as Google Play Services and abuses Androids Accessibility Service to gain control. It monitors which app is on screen and, when a target app is opened, displays a fake WebView overlay to harvest usernames, passwords, card details and PINs from victims using the targeted apps.

2. Why Crypto Apps Are High Risk

Crypto apps are explicitly included in the OverlayPhantom target list, alongside mainstream banking apps in the US, UK and several EU countries, reflecting that attackers are chasing both fiat and digital assets.

Once the malware has your credentials, it can execute remote commands, stream your screen and simulate gestures, which means an attacker can log in, approve transactions and potentially change security settings without you noticing. For crypto, this is particularly serious because on chain payments are final, so once funds are sent from your wallet, there is no customer support to reverse the transfer.

3. Practical Protection Steps

For Android users with banking or crypto apps installed, a few habits can sharply cut risk:

1. Install apps only from official stores and avoid links promising updates or bonuses through text, email or social media.
2. Review app permissions, disable unnecessary Accessibility permissions and uninstall anything that looks unfamiliar or redundant, especially if it claims to be Google Play Services.
3. Enable strong two factor authentication that is not tied to SMS on the same phone, monitor accounts for unusual activity and keep larger crypto balances on hardware wallets or a separate device that you do not use for casual browsing.

Conclusion

OverlayPhantom shows how attackers are now treating banking and crypto apps as one combined target, using sophisticated overlays and device control rather than simple phishing. For crypto holders, the main defense is not just choosing secure wallets, but also keeping the phones that run those wallets locked down, carefully updated and free from untrusted apps and links.