A dangerous new version of the “Godfather” Android malware has been discovered, and this time it’s using a much more advanced method to hack into banking apps. Instead of showing fake login screens like before, this updated malware now runs real banking apps in a virtual environment on your phone, stealing everything you type without you noticing.
This upgrade in the Godfather malware makes it way more dangerous than its older versions. Earlier, it used to rely on fake overlays, screens that looked like real banking apps but were actually fake. Users would enter their login info thinking it’s legit, and the malware would just steal it. But now, the malware is actually launching the real app inside something called a virtual container. It’s like creating a fake phone screen inside your real phone.
The trick here is that the app still looks and works like the original one. So, if you’re opening your bank app, you’re actually seeing the real interface, and everything seems fine. But behind the scenes, Godfather is watching everything you do. It tracks your taps, your PINs, your login details, even your text messages and OTPs (one-time passwords).
This is all made possible because the malware uses Android’s Accessibility Services along with tools like Xposed Framework and VirtualApp. These tools are normally used by developers for testing apps, but here they’re being abused for cybercrime. Once a banking or crypto app is launched inside this hidden environment, Godfather captures all the sensitive information that users enter.
One of the scariest parts is that Godfather can also take over your phone remotely. That means cybercriminals sitting somewhere else can open your apps, press buttons, and even make transactions, while you might just see a fake loading screen or a fake system update. In some cases, it even locks the screen at important moments, so when you enter your phone’s unlock PIN, it grabs that too.
The current version of Godfather targets about 12 banking apps in Turkey. But in the past, it has gone after more than 500 financial, crypto, and shopping apps around the world. The malware can scan your device to see which apps you have, and then hijack the ones it recognizes.
Security researchers say this version is a big leap compared to previous Android banking trojans like Anubis or Medusa. Instead of relying on tricks like overlays, Godfather now uses virtualization, which makes the attack harder to detect and more effective. It allows the malware to blend in perfectly with real apps, making it nearly invisible.
The whole point of this update seems to be avoiding detection. Since the app being used is the real one and not a fake screen, most users won’t notice anything wrong. Even Android’s built-in security systems can struggle to spot this kind of attack because everything appears to be normal on the surface.
If you’re wondering how to stay safe, here are a few important steps. First, avoid downloading apps from third-party stores or unknown sources. Always use the Google Play Store or trusted developers. Second, don’t grant apps unnecessary permissions, especially not accessibility or device admin access unless you’re sure it’s needed. And make sure Play Protect is turned on. Also, keep your phone’s software updated regularly, as updates often include security patches.
This new method of attack shows just how advanced mobile malware has become. It’s no longer just about tricking users with fake screens, it’s about taking full control, hiding in plain sight, and making users think everything is normal. That’s why staying alert and practicing good app hygiene is more important than ever.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
