SharkBot
MITRE ATT&CK: S1055 View on attack.mitre.org
Aliases: SharkBot
- Malware type
- trojan
- Family
- Malware family
- Operating systems
- android
- Related IoCs
- 36 (27 malicious)
- Last IoC activity
- 2026-09-01 16:16:25
- Profile updated
- 2026-07-07 14:04:45
Targeted industries: financial-services
Context
SharkBot is a banking malware, first discovered in October 2021, that tries to initiate money transfers directly from compromised devices by abusing Accessibility Services.
Recent IoC activity
27 malicious indicators in Maltiverse are attributed to SharkBot (S1055). The 20 most recently updated:
Malware & tools used
- Download New Code at Runtime (attack-pattern)
- Out of Band Data (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Process Discovery (attack-pattern)
- Keylogging (attack-pattern)
- Domain Generation Algorithms (attack-pattern)
- Uninstall Malicious Application (attack-pattern)
- SMS Messages (attack-pattern)
- Input Injection (attack-pattern)
- Application Versioning (attack-pattern)
- SMS Control (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- GUI Input Capture (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
- Web Protocols (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Access Notifications (attack-pattern)
Reports & references
- threatfabric.com — The Attack Of The Droppers (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Sharkbot (report)
- bin.re — The Dgas Of Sharkbot (report)
- cleafy.com — Sharkbot A New Generation Of Android Trojan Is Targeting Banks In Europe (report)
- services.google.com — Gcat Threathorizons Full Jul2023 (report)
- research.nccgroup.com — Sharkbot A New Generation Android Banking Trojan Being Distributed On Google Play Store (report)
- muha2xmad.github.io — Sharkbot (report)
- research.checkpoint.com — Google Is On Guard Sharks Shall Not Pass (report)
- blog.fox-it.com — Sharkbot A New Generation Android Banking Trojan Being Distributed On Google Play Store (report)
- blog.fox-it.com — Sharkbot Is Back In Google Play (report)
- MITRE ATT&CK — S1055 (report)