Rokarolla Android Trojan Targets 217 Banking Crypto Apps

Security researchers have identified a new and highly invasive Android banking trojan that seizes near-total control of infected smartphones to commit financial fraud while isolating victims from their banks. The malware, named Rokarolla by the mobile security firm Zimperium, was detailed in a report published on Tuesday, June 16, 2026.

Rokarolla targets 217 banking and cryptocurrency applications using a sophisticated suite of 137 remote commands. It is distributed through malicious websites that impersonate popular apps like Google Chrome and TikTok. The attack begins when a user downloads a file from these sites, which contains a dropper application disguised as Google Play Protect. This dropper tricks the user into installing the main malware payload and granting it extensive permissions, including access to Android's Accessibility Services.

Once installed, Rokarolla's primary objective is financial theft. It checks the device against its target list and downloads fake HTML login pages for any matching apps. When a victim opens a legitimate banking or crypto app, the malware overlays a counterfeit login screen to steal credentials, credit card details, and other financial...