Godfather Android Malware Returns – And It’s More Dangerous Than Ever

The post Godfather Android Malware Returns – And It’s More Dangerous Than Ever appeared first on Android Headlines.

Jun 20, 2025 - 19:20

Zimperium has spotted a new version of the Godfather malware for Android phones. Before we get to it, do note that we wrote about it in the past. The ‘Godfather’ malware actually has a long history at this point.

The Godfather Android malware first surfaced back in 2021

This malware was spotted way back in 2021, for the very first time. Then it resurfaced in December 2022. We wrote about it, as it was a rather dangerous banking trojan that needed to be stopped. At the time, it was spotted in 16 countries and attempted to steal banking credentials for over 400 online banking sites and cryptocurrency exchanges.

Fast forward to now, the Godfather malware is back. A new version was spotted amongst Turkish Android users. It is more dangerous than ever, cybersecurity researchers at Zimperium have warned.

This new version simplifies things, while it’s better at evading detection. It’s still a banking trojan that will try to steal money out of your bank account, though. Earlier variants worked as an overlay. They basically placed an invisible layer on top of your banking apps, trying to trick you into giving out your banking credentials.

The new version is far more dangerous

The new version ditches that approach, it has something more effective to use. This version creates a virtualized version of the app. On the infected device, the Godfather malware launches a virtual instance of your banking app inside a sandbox.

That way, it does not need to ask for excessive permissions in order to delve into wire fraud. Once it infects your device, it analyzes apps on your phone until it tracks down a banking app that fits the bill.

Once it does that, it will create a virtualized version that will launch whenever you try to launch a legitimate version. Needless to say, this is a rather effective way of conducting fraud.

In addition to stealing your login credentials, this malware can also exfiltrate PIN codes and unlock patterns. That way, it can remotely control the device when you’re not using it. Unfortunately, this means that it can make wire transfers completely without your knowledge.

While this malware has been spotted in Turkey only, for now, it could make its way to other markets at any point.

The post Godfather Android Malware Returns – And It’s More Dangerous Than Ever appeared first on Android Headlines.