---
title: "A new Android trojan called Rokarolla targets 217 banking apps and can steal your PIN, SMS codes, and crypto wallet funds"
url: https://daily.dev/posts/a-new-android-trojan-called-rokarolla-targets-217-banking-apps-and-can-steal-your-pin-sms-codes-an-sxasbjsfp
source_url: https://thenextweb.com/news/rokarolla-android-banking-trojan-217-apps-device-takeover
type: article
source: "The Next Web"
published: 2026-06-16T19:41:36.667Z
updated: 2026-06-16T20:35:42.910Z
tags: ["security"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# A new Android trojan called Rokarolla targets 217 banking apps and can steal your PIN, SMS codes, and crypto wallet funds

**[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments

## Summary

Zimperium's zLabs has documented Rokarolla, a new Android banking trojan targeting 217 banking and cryptocurrency apps with 137 remote commands. It spreads via fake app droppers impersonating TikTok and Chrome, then abuses Android Accessibility permissions to disable Google Play Protect, overlay fake login pages on banking apps, steal PINs via a fake lock screen, intercept SMS one-time codes, rewrite clipboard addresses to hijack crypto payments, and take covert screenshots. The malware maintains multiple fallback C2 domains, making server takedowns ineffective. No patch exists since it's malware rather than a product vulnerability; defenses include installing apps only from Google Play, keeping Play Protect enabled, and rejecting unexpected Accessibility permission requests. Indicators of compromise are published on Zimperium's GitHub.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://thenextweb.com/news/rokarolla-android-banking-trojan-217-apps-device-takeover>

## Similar posts on daily.dev

- [New Rokarolla Android malware targets 217 banking, crypto apps](https://daily.dev/posts/new-rokarolla-android-malware-targets-217-banking-crypto-apps-w7sotfpil) · BleepingComputer · 0 upvotes · 0 comments
- [Rokarolla Android Trojan Levels Up to Full Device Control](https://daily.dev/posts/rokarolla-android-trojan-levels-up-to-full-device-control-wvualwe8p) · Dark Reading · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security)

[View this post on daily.dev](https://daily.dev/posts/a-new-android-trojan-called-rokarolla-targets-217-banking-apps-and-can-steal-your-pin-sms-codes-an-sxasbjsfp)