Malware family
GhostGrab
GhostGrab is an Android malware family, described by CyFirma as a new Android banking trojan that combines financial data theft with covert cryptocurrency mining.
Profile source: Mallory opens in a new tabGhostGrab
Family profile
GhostGrab is an Android malware family, described by CyFirma as a new Android banking trojan that combines financial data theft with covert cryptocurrency mining. Reported capabilities include theft of banking credentials, payment card details, personal information, and broader data exfiltration, alongside covert Monero mining on infected devices. The available reporting characterizes it as using advanced persistence and stealth techniques. It is associated in the provided content with Android/mobile targeting; no specific threat actor attribution, victimology, infection vector, or indicators of compromise are provided in the source material.
MITRE ATT&CK
GhostGrab in ATT&CK
2 distinct techniquesReporting
Research mentioning GhostGrab
Oct 31
Ahnlab Asec
Mobile Security & Malware Issue 5st Week of October, 2025
Tags:apk GhostGrab HCE Herodorus KYC malware NFC Tab-and-Steal YNRK
Oct 28
Risky Biz Rss
Risky Bulletin: HackingTeam successor linked to recent Chrome zero-days
CyFirma researchers have spotted GhostGrab, a new Android banking trojan that also dabbles in info-stealing and cryptomining.
Oct 28
Security Online Info
GhostGrab Android Malware Combines Covert Monero Mining with Financial Credential Theft
GhostGrab Android Malware Combines Covert Monero Mining with Financial Credential Theft
