A sophisticated new version of the Android malware “Godfather” has emerged, using advanced virtualization techniques to steal sensitive financial information from mobile banking applications. This malware creates isolated virtual environments on infected devices, allowing cybercriminals to spy on users and manipulate transactions in real-time.

## How Godfather Works

The malware operates by embedding a virtualization framework within a malicious APK file, utilizing open-source tools like VirtualApp engine and Xposed for system hooking. Once installed, Godfather scans for targeted banking applications and places them inside its controlled virtual environment.

When users launch their legitimate banking apps, the malware intercepts the action through accessibility service permissions and redirects it to a “StubActivity” – a placeholder that acts as a proxy for the real application. This creates a deceptive layer where users see the authentic app interface while all their interactions are secretly monitored and controlled.

## Advanced Deception Techniques

The malware’s sophistication lies in its ability to maintain perfect visual deception. Users interact with what appears to be their genuine banking app, but Godfather captures:

– Account credentials and passwords
– PINs and touch events
– Banking backend responses
– Transaction details

To further deceive victims, the malware displays fake lock screen overlays to trick users into entering sensitive information. During unauthorized transactions, users see fake “update” screens or black screens to avoid suspicion.

## Global Threat Scope

Godfather targets over 500 banking, cryptocurrency, and e-commerce applications worldwide, representing a significant expansion from previous versions. The malware first appeared in March 2021 and has evolved considerably since then. While current campaigns focus on Turkish banking apps, security researchers warn that operators could easily activate other subsets to target different regions.

## Evolution of the Threat

This latest version represents a major advancement from the December 2022 variant, which targeted 400 apps across 16 countries using HTML overlay techniques. The new virtualization approach makes detection significantly more difficult, as Android’s security protections only see the host application’s declared activities.

## Protection Measures

To defend against Godfather and similar threats, security experts recommend:

– Download apps only from Google Play Store or trusted publishers
– Keep Google Play Protect active
– Carefully review app permissions before installation
– Monitor banking accounts regularly for unauthorized activity

The emergence of virtualization-based Android malware represents a concerning evolution in mobile threats, requiring enhanced security awareness and protective measures from both users and financial institutions.