← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Herodotus Android Trojan Mimics Human Typing to Evade Detection
WHITE Herodotus CODERED_VTA 2025-10-29 Modified: 2025-10-29
3
IOCs
LOW VOLUME
A new type of banking Trojan has been discovered in Brazil and Italy and is being used to steal credentials from victims' bank accounts, according to a new report by ThreatFabric analysts from the UK.
herodotusbrokewelltrojanmobile threatitalybrazilandroidperformsendset urlhookclickbackcodeaprilbehavioursha256 package
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Herodotus
Indicators of Compromise (3)
All FileHash-SHA256 domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 53ee40353e17d069b7b7783529edda968ad9ae25a0777f6a644b99551b412083 — 2025-10-29
domain google-firebase.digital — 2025-10-29
hostname gj23j4jg.google-firebase.digital — 2025-10-29
References (1)
↗ https://www.threatfabric.com/blogs/new-android-malware-herodotus-mimics-human-behaviour-to-evade-detection