Hackers launch new Android virus capable of intercepting cryptocurrency transactions in real time

Hackers have launched a global campaign against more than 400 financial apps, including cryptocurrency, banking, and trading apps, using a new type of Android malware called Albiriox. According to Cleafy, a cybersecurity company, this virus is a sophisticated remote access trojan (RAT) capable of taking full control of an infected device and gaining direct access to users' bank or crypto wallets.

According to experts, Albiriox is spread through fake applications that imitate genuine ones. Attackers create fake Google Play pages and send installation links via SMS. One example is the fake Penny Market app. After the user grants installation permissions, the program installs malware on the device.

Albiriox is particularly dangerous because it belongs to the class of so-called On-Device Fraud (ODF), which is fraud directly on the user’s device. The virus uses a combination of remote access via VNC, abuse of the Android availability service, fake screens, and dynamic credential collection. This allows the malware to bypass biometric authentication, two-factor authentication, and fraud detection systems by imitating the actions of a legitimate user.

Having gained access rights, attackers are able to control the victim’s phone in real time: make transfers, empty crypto wallets, or confirm risky transactions. Since these actions are performed from the user’s device, financial institutions are often unable to detect suspicious activity until the funds are stolen.

Cleafy experts warn that Albiriox marks a new evolution in mobile cybercrime, focusing on full device hijacking and real-time theft. The researchers predict that the number of such attacks will grow and their sophistication will increase, especially against users of cryptocurrencies, mobile banks, and fintech applications.