New Android Malware Klopatra Enables Remote Control Through Stealth VNC Access
A sophisticated new Android banking trojan dubbed Klopatra has infected over 3,000 European devices by masquerading as an IPTV and VPN app. The malware gives attackers complete remote control through a hidden Virtual Network Computing (VNC) system for remote access capability while remaining undetected.
Cybersecurity firm Cleafy discovered this Turkish-origin malware that combines banking credential theft, keystroke logging, and cryptocurrency wallet targeting with advanced evasion techniques. As one of the most sophisticated types of malware targeting financial data, the trojan represents a concerning evolution in mobile malware capabilities.
Sophisticated Stealth and Control Features
The malware infiltrates devices through a malicious app called "Modpro IP TV + VPN" distributed outside the Google Play Store. Using commercial-grade protection tools like Virbox, Klopatra employs multiple layers of anti-detection measures including:
- Runtime integrity checks
- Emulator detection
- Native library implementation to minimize code footprint
- Advanced string encryption
Its most dangerous feature is a black-screen VNC mode that lets attackers remotely control the device while appearing powered off to users. This enables covert financial transactions through simulated taps, swipes and gestures.
Widespread Impact and Rapid Evolution
Since its March 2025 emergence, Klopatra has seen 40 distinct versions, indicating active development. Understanding the growing threat of sophisticated mobile malware attacks targeting Android devices is crucial for protection. The malware:
- Targets banking credentials via overlay attacks
- Captures clipboard content and keystrokes
- Collects cryptocurrency wallet information
- Attempts to disable popular antivirus products
- Has infected approximately 3,000 unique devices
Protecting Against the Threat
Users can defend against Klopatra by:
- Only downloading apps from the official Google Play Store
- Declining Accessibility Service permission requests
- Keeping Google Play Protect enabled
- Being wary of apps requesting excessive permissions
- Installing reputable mobile security solutions
- Regularly monitoring bank statements for suspicious activity
The emergence of Klopatra highlights the growing sophistication of mobile malware. Its ability to provide covert remote access while evading detection represents a significant evolution in Android-targeted threats that requires heightened user vigilance.
For more information about emerging Android malware threats, visit the Android Security Bulletin.
