Catelites
- First seen
- 2017-12-01 00:00:00
- Malware type
- botnet, trojan, credential-stealer
- Family
- Malware family
- Last IoC activity
- 2026-05-02 13:25:20
- Profile updated
- 2026-07-07 14:04:58
Targeted industries: financial-services
Context
Catelites Bot (identified by Avast and SfyLabs in December 2017) is an Android trojan, with ties to CronBot. Once the malicious app is installed, attackers use social engineering tricks and window overlays to get credit card details from the victim. The distribution vector seems to be fake apps from third-party app stores (not Google Play) or via malvertisement. After installation and activation, the app creates fake Gmail, Google Play and Chrome icons. Furthermore, the malware sends a fake system notification, telling the victim that they need to re-authenticate with Google Services and ask for their credit card details to be entered. Currently the malware has overlays for over 2,200 apps of banks and financial institutions.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Apk.Catelites (report)
- blog.avast.com — New Version Of Mobile Malware Catelites Possibly Linked To Cron Cyber Gang (report)
- youtube.com — Watch (report)