Cybersecurity researchers at Dutch mobile security firm ThreatFabric have discovered a new Android banking trojan called Massiv that gives attackers full remote control over infected devices. The malware spreads through fake IPTV streaming apps and is designed to steal banking credentials and carry out fraudulent transactions directly from victims’ accounts.
Who Is Being Targeted?
The first major campaign was spotted earlier this year and focused on users in Portugal and Greece, though malware samples suggest the attackers were quietly testing it as far back as early 2025.
One campaign specifically went after users of gov.pt, the Portuguese government app that lets citizens store ID documents and use the country’s Digital Mobile Key system. The malware displayed fake login screens to trick users into entering their phone numbers and PINs — information that was then used to bypass identity verification checks at banks. In some cases, attackers used the stolen credentials to open fraudulent bank accounts, take out unauthorized loans, and launder money.
What Can It Do?
Massiv is a full remote access trojan (RAT) with a wide set of capabilities. It streams the victim’s screen back to attackers using Android’s built-in MediaProjection API, logs keystrokes, intercepts SMS messages, and overlays fake login screens on top of legitimate banking apps to capture passwords and card details.
When screen capture protections are active, the malware switches to an alternative technique it uses called UI-tree mode. Rather than recording the screen visually, it walks through Android’s Accessibility Service structures — specifically AccessibilityWindowInfo roots and their child AccessibilityNodeInfo objects — to build a detailed JSON map of everything visible on screen. This map includes text fields, content descriptions, element coordinates, and interaction flags like whether something is clickable or editable. Only nodes with visible text are sent to the attacker’s server, making the technique harder to detect than traditional screen capture.
Beyond observation, Massiv can actively take over the device. Attackers can tap and swipe, modify clipboard contents, unlock the device using a stored pattern, install additional malicious APKs, push overlay templates for specific apps, and suppress notifications by muting sound and throwing up a black screen overlay. They can also tamper with battery optimization settings, disable Play Protect, and manage device administrator permissions to entrench their access.
How Does It Get Installed?
The infection usually starts with an SMS phishing message that leads victims to download a fake IPTV app. The dropper app — observed under the package name hfgx.mqfy.fejku posing as “IPTV24” — then prompts the user to approve an “important update” that requires permission to install apps from unknown sources. Once granted, it silently installs the actual Massiv payload, which has been observed using the package name hobfjp.anrxf.cucm disguised as Google Play.
To avoid suspicion, the dropper loads a real IPTV website in a WebView so the app appears functional while Massiv runs in the background.
The Bigger Picture
Massiv is entering an already crowded field of Android banking malware, but it stands out for its modular build and signs of ongoing active development. Researchers spotted API key mechanisms baked into its communication protocol, which suggests the authors may be planning to sell it as a Malware-as-a-Service platform in the future. For now the campaigns are relatively contained, but the toolset is sophisticated enough to cause serious financial damage at scale if distribution expands.