Mobdro Pro IP TV + VPN hides Klopatra, a new Android Trojan that lets attackers steal banking credentials.

Mobdro Pro IP TV + VPN hides Klopatra, a new Android Trojan that lets attackers steal banking credentials.

Mobdro Pro IP TV + VPN hides Klopatra, a new Android Trojan that lets attackers steal banking credentials.

Security researchers are warning Android users to delete a fake VPN and streaming app that can let criminals take over their phones and drain their bank accounts. The app, Mobdro Pro IP TV + VPN, was discovered by researchers at Cleafy to be a malicious sideloaded app, not a legitimate VPN. Their analysis found it installs Klopatra, a new Android banking Trojan and remote-access tool with no links to known malware families. Klopatra targets banking customers and gives attackers full remote control of infected devices, allowing them to steal credentials and carry out fraudulent transactions. The researchers found that: > “Klopatra’s effectiveness lies in a carefully orchestrated infection chain, which begins with social engineering and culminates in the complete takeover of the victim’s device. Each stage is designed to overcome the defenses of the user and the Android operating system.” The lure works by pretending to be an IPTV app that offers free, high-quality TV channels. Because pirated streaming apps are so common, users often expect to install them from unofficial websites (sideloading), unintentionally bypassing the protections of the Google Play Store. Klopatra is an extreme example of a fake virtual private network (VPN) used to spread malware, but it’s not the only reason to be cautious. Even genuine VPNs on Google Play can have hidden risks, from vague ownership to weak privacy protections. ## Even genuine VPNs can be risky VPNs are often promoted as essential tools for privacy, circumventing geo-blocks, or bypassing age verification controls. For hundreds of millions of users, VPN connections are the solution to hide the user’s IP address and location, and to encrypt web traffic so it’s useless when intercepted. But picking a VPN you can trust is not always easy. Even if you get one from the official Play Store. A recent study, the VPN Transparency Report 2025 by the Open Technology Fund, revealed alarming shortcomings among some of the world’s most-downloaded VPN apps. The researchers examined the ownership, operation, and development of 32 commercial VPNs, collectively used by more than a billion people. Among the apps flagged as “concerning” are very popular solutions like Turbo VPN, VPN Proxy Master, XY VPN, and 3X VPN – Smooth Browsing, each of which has been downloaded at least 100 million times from the Google Play Store. Some of these solutions even provide a false sense of privacy by using technologies that weren’t designed for privacy at all, the study claims. They found that several: > “providers use the Shadowsocks tunneling protocol [which is not designed for confidentiality] to build the VPN tunnel, and claim their users’ connections are secure.” The report emphasizes how important it is to gather information before installing a VPN: it’s worth learning who runs it, how it’s built, and what it does with your data. This is key for users to make informed decisions. ## Practical tips on how to protect yourself * **Stick to trusted sources.** Download apps—especially VPNs and streaming services—only from Google Play, Apple’s App Store, or the official provider. Never install something just because a link in a forum or message promises a shortcut. * **Check an app’s permissions.** If an app asks for control over your device, your settings, Accessibility Services, or wants to install other apps, stop and ask yourself why. Does it really need those permissions to do what you expect it to do? * ****Use layered, up-to-date protection.** **Install****real-time anti-malware protection on your Android that scans for new downloads and suspicious activity. Keep both your security software and your device system updated—patches fix vulnerabilities that attackers can exploit. * **Stay informed.** Follow trustworthy cybersecurity news and share important warnings with friends and family. ### **If you think you’ve been affected:** Delete any suspicious VPN or IPTV apps, run a trusted security scan, and reset your banking credentials if you suspect your device has ever been compromised. For your peace of mind and your wallet’s safety, choose your VPN wisely. * * * **We don’t just report on privacy—we offer you the option to use it.** Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

Mobdro Pro IP TV + VPN hides Klopatra, a new Android Trojan that lets attackers steal banking credentials.

Una aplicación que promete acceso gratuito a canales de televisión y navegación segura en Android ha generado una alerta entre expertos en ciberseguridad. Según la firma italiana Cleafy, la app Mobdro Pro IP TV + VPN aparenta ser una herramienta legítima de streaming y VPN, pero en realidad instala un troyano bancario avanzado llamado Klopatra, capaz de robar credenciales y vaciar cuentas bancarias.

More than 3,000 devices have already been infected by the Android malware

Siber güvenlik uzmanları, “Mobdro Pro IP TV + VPN” adlı sahte uygulamanın kullanıcıların banka hesaplarını hedef aldığını açıkladı. Uzmanlar, uygulamayı indirenlerin vakit kaybetmeden silmeleri ve…

  A disturbing revelation that highlights the persistent threat that malicious software poses to Android users has been brought to the attention of cybersecurity researchers, who have raised concerns over a deceptive application masquerading as a legitimate streaming and VPN application. Despite the app's promise that it offers free access to online television channels and virtual private networking features—as well as the name Modpro IPTV Plus VPN—it hides a much more dangerous purpose. It is known as Mobdro Pro IPTV Plus VPN. Cleafy conducted an in-depth analysis of this software program and found that, as well as functioning as a sophisticated Trojan horse laced with Klopatra malware, it is also able to compromise users' financial data, infiltrating devices, securing remote controls, and infecting devices with Klopatra malware.  Even though it is not listed in Google Play, it has spread through sideloaded installations that appeal to users with the lure of free services, causing users to download it. There is a serious concern among experts that those who install this app may unknowingly expose their devices, bank accounts, and other financial assets to severe security risks. At first glance, the application appears to be an enticing gateway to free, high-quality IPTV channels and VPN services, and many Android users find the offer hard to refuse.  It is important to note, however, that beneath its polished interface lies a sophisticated banking Trojan with a remote-access toolkit that allows cybercriminals to control almost completely infected devices through a remote access toolkit. When the malware was installed on the device, Klopatra, the malware, exploiting Android's accessibility features, impersonated the user and accessed banking apps, which allowed for the malicious activity to go unnoticed. Analysts have described the infection chain in a way that is both deliberate and deceptive, using social engineering techniques to deceive users into downloading an app from an unverified source, resulting in a sideload process of the app. Once installed, what appears to be a harmless setup process is, in fact, a mechanism to give the attacker full control of the system.  In analyzing Mobdro Pro IPTV Plus VPN further, the researchers have discovered that it has been misusing the popularity of the once popular streaming service Mobdro (previously taken down by Spanish authorities) to mislead users and gain credibility, by using the reputation of the once popular streaming service Mobdro.  There are over 3,000 Android devices that have already been compromised by Klopatra malware, most of which have been in Italy and Spain regions, according to Cleafy, and the operation was attributed to a Turkish-based threat group. A group of hackers continue to refine their tactics and exploit public frustration with content restrictions and digital surveillance by using trending services, such as free VPNs and IPTV apps.  The findings of Cleafy are supported by Kaspersky's note that there is a broader trend of malicious VPN services masquerading as legitimate tools. For example, there are apps such as MaskVPN, PaladinVPN, ShineVPN, ShieldVPN, DewVPN, and ProxyGate previously linked to similar attacks. In an effort to safeguard privacy and circumvent geo-restrictions online, the popularity of Klopatra may inspire an uproar among imitators, making it more critical than ever for users to verify the legitimacy of free VPNs and streaming apps before installing them. Virtual Private Networks (VPNs) have been portrayed for some time as a vital tool for safeguarding privacy and circumventing geo-restrictions.  There are millions of internet users around the world who use them as a way to protect themselves from online threats — masking their IP addresses, encrypting their data traffic, and making sure their intercepted communications remain unreadable. But security experts are warning that this perception of safety can sometimes be false. In recent years, it has become increasingly difficult to select a trustworthy VPN, even when downloading it directly from official sites, such as the Google Play Store, since many apps are allegedly compromising the very privacy they claim to protect, which has made the selection process increasingly difficult. In the VPN Transparency Report 2025, published by the Open Technology Fund, significant security and transparency issues were highlighted among several VPN applications that are widely used around the world.  During the study, 32 major VPN services collectively used by over a billion people were examined, and the findings revealed opaque ownership structures, questionable operational practices, and the misuse of insecure tunnelling technologies. Several VPN services, which boasted over 100 million downloads each, were flagged as particularly worrying, including Turbo VPN, VPN Proxy Master, XY VPN, and 3X VPN – Smooth Browsing.  Several providers utilised the Shadowsocks tunnelling protocol, which was never intended to be private or confidential, and yet was marketed as a secure VPN solution by researchers. It emphasises the importance of doing users' due diligence before choosing a VPN provider, urging users to understand who operates the service, how it is designed, and how their information is handled before making a decision.  It is also strongly advised by cybersecurity experts to have cautious digital habits, including downloading apps from verified sources, carefully reviewing permission requests, installing up-to-date antivirus software, and staying informed on the latest cybersecurity developments through trusted cybersecurity publications. As malicious VPNs and fake streaming platforms become increasingly important gateways to malware such as Klopatra, awareness and vigilance have become increasingly important defensive tools in the rapidly evolving online security landscape.  As Clearafy uncovered in its analysis of the Klopatra malware, the malware represents a new level of sophistication in Android cyberattacks, utilising several sophisticated mechanisms to help evade detection and resist reverse engineering. As opposed to typical smartphone malware, Klopatra permits its operators to fully control an infected device remotely—essentially enabling them to do whatever the legitimate user is able to do on the device.  It has a hidden VNC mode, which allows attackers to access the device while keeping the screen black, making them completely unaware of any active activities going on in the device. This is one of the most insidious features of this malware. If malicious actors have access to such a level of access, they could open banking applications without any visible signs of compromise, initiate transfers, and manipulate device settings without anyone noticing. A malware like Klopatra has strong defensive capabilities that make it very resilient. It maintains an internal watchlist of popular Android security applications and automatically attempts to uninstall them once it detects them, ensuring that it stays hidden from its victim. Whenever a victim attempts to uninstall a malicious application manually, they may be forced to trigger the system's "back" action, which prevents them from doing so.  The code analysis and internal operator comments—primarily written in Turkish—led investigators to trace the malware’s origins to a coordinated threat group based in Turkey, where most of their activities were directed towards targeting Italian and Spanish financial institutions. Cleafy's findings also revealed that the third server infrastructure is carrying out test campaigns in other countries, indicating an expansion of the business into other countries in the future.  With Klopatra, users can launch legitimate financial apps and a convincing fake login screen is presented to them. The screen gives the user the appearance of a legitimate login page, securing their credentials via direct operator intervention. The campaign evolved from a prototype created in early 2025 to its current advanced form in 2035. This information is collected and then used by the attackers in order to access accounts, often during the night when the device is idle, making suspicions less likely.  A few documented examples illustrate that operators have left internal notes in the app's code in reference to failed transactions and victims' unlock patterns, which highlights the hands-on nature of these attacks. Cybersecurity experts warn that the best defence against malware is prevention - avoiding downloading apps from unverified sources, especially those that offer free IPTV or VPN services. Although Google Play Protect is able to identify and block many threats, it cannot detect every emerging threat.  Whenever an app asks for deep system permissions or attempts to install secondary software, users are advised to be extremely cautious. According to Cleafy's research, curiosity about "free" streaming services or privacy services can all too easily serve as a gateway for full-scale digital compromise, so consumers need to be vigilant about these practices. In a time when convenience usually outweighs caution, threats such as Klopatra are becoming increasingly sophisticated. A growing number of cybercriminals are exploiting popular trends such as free streaming and VPN services to ensnare unsuspecting users into ensnaring them. As a result, it is becoming increasingly essential for each individual to take steps to protect themselves. Experts recommend that users adopt a multi-layered security approach – pairing a trusted VPN with an anti-malware tool and enabling multi-factor authentication on their financial accounts to minimise damage should their account be compromised.  The regular review of system activity and app permissions can also assist in detecting anomalies before they occur. Additionally, users should cultivate a sense of scepticism when it comes to offers that seem too good to be true, particularly when they promise unrestricted access and “premium” services without charge. In addition, organisations need to increase awareness campaigns so consumers are able to recognise the warning signs of fraudulent apps.  The cybersecurity incidents serve as a reminder that cybersecurity is not a one-time safeguard, but must remain constant through vigilance and informed decisions throughout the evolving field of mobile security. Awareness of threats remains the first and most formidable line of defence as the mobile security battlefield continues to evolve.

Mobdro Pro IP TV + VPN hides Klopatra, a new Android Trojan that lets attackers steal banking credentials.

"Mobdro Pro IP TV + VPN" adlı sahte Android uygulaması, içerdiği "Kleopatra" zararlı yazılımı ile binlerce kullanıcının banka hesaplarını tehlikeye attı. Uzmanlar, uygulamayı indiren herkese acil uyarıda bulundu. UYGULAMA, KULLANICIYI KORSAN İÇERİK VAADİYLE TUZAĞA DÜŞÜRÜYOR Saldırganlar, söz konusu uygulamayı bedava film, dizi ve spor yayını vaadiyle sunarak cihazlara sızdı. Uygulama, korsan yayın içeriği göstererek güven kazanıyor ve genellikle üçüncü taraf uygulama platformları ya da paylaşım linkleriyle yayılıyor.

Aplikasi Streaming Bola Rekomendasi Buat Kamu Tonton Yaitu 1.SuperSport 2.MAXstream 3.Mola Tv 4.Mobdro Sport 5.UseeTV GO.

Download mobdro "Copyright Disclaimer Under Section 107 of the Copyright Act 1976, allowance is made for "fair use" for purposes such as criticism, comment, news reporting, teaching, scholarship, and research. Fair use is a use permitted by copyright statute that might otherwise be infringing. Non-profit, educational or personal use tips the balance in favor of fair use" source

セキュリティ企業Cleafyが偽VPNアプリ「Mobdro Pro IP TV+VPN」から新型バンキング型トロイの木馬Klopatraを発見。銀行口座乗っ取りが可能に。VPN透明性レポート2025では正規VPN32種を調査、Turbo VPNなど人気アプリにも懸念。サイドローディングの危険性と対策を解説。