DoubleTrouble represents a concerning evolution in mobile banking malware, combining traditional overlay attacks with cutting-edge capabilities including comprehensive screen recording, advanced keylogging, and real-time device manipulation. DoubleTrouble can capture screen content in real-time, monitor every keystroke, block legitimate banking applications, and present convincing fake interfaces designed to harvest sensitive financial information. A sophisticated new banking trojan dubbed DoubleTrouble has emerged as a significant threat to mobile users across Europe, employing advanced evasion techniques and expanding its attack surface through novel distribution channels. The malware’s ability to record exactly what users see enables attackers to bypass traditional security measures, intercept one-time passwords, and gain access to highly confidential financial data through visual observation rather than direct application compromise. The research team’s analysis revealed the malware’s rapid evolution in both distribution methods and technical capabilities, marking it as one of the most sophisticated banking trojans observed in recent months. The complete payload is transmitted to the command and control server, providing attackers with an unobstructed view of all user activities including banking transactions, cryptocurrency operations, and password manager interactions. The malware initially spread through phishing websites impersonating well-known European banking institutions, but has recently evolved to leverage bogus websites hosting malicious samples directly within Discord channels. DoubleTrouble’s most concerning feature lies in its sophisticated screen recording capability, which leverages Android’s MediaProjection and VirtualDisplay APIs to achieve comprehensive visual surveillance. Security researchers at Zimperium identified this banking trojan during extensive monitoring operations, collecting 25 samples of earlier variants and 9 samples from the current campaign.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 31 Jul 2025 23:20:18 +0000