Datzbro

Datzbro is an Android malware family described by ThreatFabric as a banking trojan with spyware capabilities that supports device takeover (DTO) attacks and fraudulent transactions. It has been observed in scam campaigns that prey on elderly users, including Facebook groups advertising social activities for seniors. In the reported activity, victims were lured with convincing, sometimes AI-generated posts, moved to Messenger or WhatsApp, and then directed to fake registration sites that prompted installation of a supposed “community app.” Datzbro was delivered either directly or via the Zombinder Android dropper.

The malware is reported to combine spyware and banking-trojan functionality. Documented capabilities include remote access, keylogging, phishing, audio recording, camera access, file theft, and theft of banking and cryptocurrency credentials. ThreatFabric also reported that Datzbro can capture passwords for Alipay and WeChat, as well as device PIN codes. Its DTO and interaction techniques abuse Android Accessibility services, a technique also noted in other Android banking malware.

ThreatFabric warned that Datzbro poses a broader global risk because its builder and command-and-control software leaked online, making it available to other criminals. The campaign was first noticed in Australia and later observed in Singapore, Malaysia, Canada, South Africa, and the U.K. Researchers noted Chinese-language strings in the malware code and command-and-control interface, suggesting possible China-based development, but the campaign was not attributed to a specific threat group. Earlier activity reportedly targeted Chinese-speaking users, leading researchers to suggest it may have initially been used domestically before spreading more widely.