{
  "family": "dyloader",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:AndroidOS/Dyloader is a mobile banking trojan targeting the Android operating system. Unlike Windows-based banking trojans that rely on web injects, Dyloader represents the mobile-centric approach to financial theft: it utilizes deceptive Overlay Attacks (`T1636`) to steal credentials and aggressively abuses Android Accessibility Services (`T1628`) to intercept multi-factor authentication (MFA) SMS messages.<br><br><b>Understanding Dyloader (Android Banking Trojans)</b><br>To a mobile user, Dyloader typically masquerades as a legitimate application—often a utility app (like a PDF reader or Flash player) downloaded from a third-party app store or pushed via a phishing SMS (Smishing). For a threat analyst, Dyloader is a highly interactive threat where the attacker monitors the device in real-time, waiting for the user to open a targeted banking application.<br><br><b>Execution and Credential Theft Mechanics</b><br>Once installed, Dyloader immediately requests extensive permissions, most critically asking the user to enable Accessibility Services (`T1628`). With Accessibility enabled, the trojan gains near-total control over the device UI. When the user launches a targeted banking app, Dyloader detects the app launch and instantly draws a fake login screen *over* the legitimate app (`T1636`). The user unwittingly enters their credentials into the malware's overlay. The trojan then leverages its Accessibility permissions to silently read incoming SMS messages (`T1624.001`), capturing the bank's OTP/MFA codes and sending them to the attacker's C2 server to complete the fraudulent transaction.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct financial theft and full compromise of the user's mobile banking identity. Device-based IoCs include applications requesting Accessibility Services that have no legitimate need for them (e.g., a 'Flashlight' app requesting screen reading permissions). A key behavioral indicator is a slight delay or 'flicker' when opening a banking application, signifying the overlay being drawn. Network IoCs include the device maintaining a constant heartbeat connection to an unknown C2 server via HTTPS.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1636",
    "T1628",
    "T1479",
    "T1624.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1636",
      "name": "Data from Local System: Screen Capture (Using Overlay Attacks to steal credentials)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1628",
      "name": "Abuse Elevation Control Mechanism: Accessibility Services (The core mechanism for UI manipulation and SMS theft)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1624.001",
      "name": "Data from Information Repositories: Short Message Service (SMS) (Intercepting MFA tokens)",
      "tactic": "Collection"
    },
    {
      "id": "T1479",
      "name": "System Information Discovery (Profiling installed banking apps)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Boot the Android device into 'Safe Mode' (which disables third-party apps) to bypass the trojan's UI blocks.",
    "Navigate to `Settings -> Accessibility` and immediately revoke Accessibility permissions from the suspicious application.",
    "Go to `Settings -> Apps` and manually uninstall the malicious application.",
    "Contact the affected financial institutions immediately to freeze accounts and report the compromised MFA tokens."
  ],
  "what_to_avoid": [
    "Do not blindly grant Accessibility Services to applications; this is the most dangerous permission in the Android ecosystem.",
    "Avoid downloading applications from untrusted third-party app stores or side-loading APKs sent via SMS."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}