FvncBot, SeedSnatcher, and ClayRat Android malware variants have added stronger data theft functions, increasing risks for mobile users.

New Android malware found Researchers have revealed details of two Android malware strains called SeedSnatcher and FvncBot. Upgraded version of ClayRat was also found in the wild.  About the malware  FvncBot works as a security app built by mBank and attacks mobile banking users in Poland. The malware is written from scratch and is different from other banking trojans such as ERMAC whose source codes have been leaked. According to Intel 471, the malware "implemented multiple features including keylogging by abusing Android's accessibility services, web-inject attacks, screen streaming and hidden virtual network computing (HVNC) to perform successful financial fraud." Like the Albiriox banking malware, this trojan is shielded by a service called apk0day that Golden Crypt offers. Attack tactic  After the dropper app is launched, users are asked to download a Google Play component for security of the app. But in reality, it deploys the malware via session-based approach which other actors adopt to escape accessibility restrictions on Android devices version 13 and above. According to Intel 471, "During the malware runtime, the log events were sent to the remote server at the naleymilva.it.com domain to track the current status of the bot." After this, the malware asks victims for accessibility services permission, it then gets privileges and connects to an external server.  Malware capabilities  FvncBot also triggers a text mode to analyze the device screen layout and content even in cases where an app doesn't allow screenshots by setting the FLAG_SECURE option.  Experts don't yet know how FvncBot is getting widespread, but Android banking trojans leverage third-party app stores and SMS phishing as a distribution vector.  According to Intel 471, "Android's accessibility service is intended to aid users with disabilities, but it also can give attackers the ability to know when certain apps are launched and overwrite the screen's display."  The firm added that the sample was built to "target Polish-speaking users, it is plausible we will observe this theme shifting to target other regions or to impersonate other Polish institutions." Beyond the immediate threat to banking and cryptocurrency users, the emergence of FvncBot, SeedSnatcher, and the upgraded ClayRat underscores a troubling evolution in mobile-malware design: an increasing shift toward “full-device takeover” rather than mere credential theft. By exploiting legitimate features, such as Android’s accessibility services, screen-streaming APIs, and overlay permissions, these trojans can invisibly hijack almost every function of a smartphone: logging keystrokes, intercepting SMS-delivered 2FA codes, capturing screen contents even when apps try to block screenshots, and executing arbitrary commands as though the real user were interacting with the device.  This marks a new class of threat in which a compromised phone becomes a proxy tool for remote attackers: they don’t just steal data, they can impersonate the user, conduct fraudulent transactions, or monitor every digital activity. Hence, users worldwide, not only in Poland or crypto-heavy regions, must remain vigilant: the architecture these threats use is platform-wide, not region-specific, and could easily be repurposed for broader global campaigns.

A dangerous new malicious application has surfaced, targeting mobile banking customers in Poland. Observed on November 25, 2025, this threat masquerades as a legitimate security tool purportedly from mBank, a major Polish financial institution. The application serves as a gateway for a novel banking trojan that operates silently in the background. By mimicking trusted banking software, the attackers successfully deceive users into installing the malware, which then attempts to compromise their financial accounts through sophisticated surveillance techniques. The infection process begins when the fake app prompts the user to install an additional “Play” component, claiming it is required for system stability. This step is a critical trick designed to bypass security restrictions found on modern Android devices. The malicious loader leverages this permission to deploy the payload, ensuring it can operate persistently on the victim’s phone. Process enabling the accessibility service of the payload application (Source – Intel471) This social engineering tactic effectively lowers the user’s guard, allowing the threat to establish a foothold before any data theft begins. Intel 471 researchers identified this specific strain and named it FvncBot, noting that its programming code is entirely original and not derived from leaked sources of other notorious banking trojans. This uniqueness suggests a new group of developers is responsible. FvncBot unleashes invasive features to steal money, primarily by recording keystrokes and capturing screen content. It also utilizes hidden virtual network computing, which allows cybercriminals to perform actions on the infected device remotely, facilitating fraudulent transfers while the victim remains unaware. Abusing Accessibility for Persistence The most alarming aspect of FvncBot is its manipulation of Android’s accessibility services to maintain control. After installation, the malware aggressively requests these high-level privileges, guiding the victim to system settings to approve them. If the user complies, the malware gains the ability to read text on the screen and track every tap. Payload installation process (Source – Intel471) With accessibility services enabled, FvncBot can harvest data from any open application, including secure banking portals. It logs these details into a storage buffer and transmits them to a remote server. Furthermore, the malware establishes a high-speed connection using WebSockets, allowing operators to issue commands instantly. This setup enables them to stream the victim’s screen and manipulate the device remotely to commit fraud. To stay safe, users are strongly advised to avoid installing banking applications from unofficial websites and organic search results to prevent such dangerous infections. Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google . The post New FvncBot Attacking Android Users by Exploiting Accessibility Services appeared first on Cyber Security News .

Cybersecurity researchers have disclosed details of two new Android malware families dubbed FvncBot and SeedSnatcher, as another upgraded version of ClayRat has been spotted in the wild. The findings come from Intel 471, CYFIRMA, and Zimperium, respectively. FvncBot, which masquerades as a security app developed by mBank, targets mobile banking users in Poland. What's notable about the malware

A previously undocumented Android banking trojan dubbed "FvncBot." First observed in late 2025, this sophisticated malware disguises itself as a security application from mBank.

Researchers detail FvncBot, SeedSnatcher, and a stronger ClayRat that widen Android data theft and device control tactics.

Cybersecurity researchers at Intel 471 have discovered a dangerous new Android banking malware named FvncBot.

Security researchers have uncovered a sophisticated new Android malware strain targeting mobile banking users, FvncBot.

A newly discovered Android banking trojan, FvncBot, has emerged as a sophisticated threat targeting mobile banking users in Poland.

Researchers detail FvncBot, SeedSnatcher, and a stronger ClayRat that widen Android data theft and device control tactics.

Eyal Estrin unread, 8:59 PM (17 minutes ago)    to https://www.intel471.com/blog/new-fvncbot-android-banking-trojan-targets-poland Eyal Estrin CISSP, CCSP, CISM, CISA, CDPSE, CCSK Blog: https://security-24-7.com | Books: https://amzn.to/42Xai9A | https://amzn.to/3Sggbtv Twitter: @eyalestrin | Bluesky: @eyalestrin.bsky.social