Android Trojan OverlayPhantom Targets 180+ Banking and Crypto Apps Across 10 Countries, Cyble Reports

According to cybersecurity firm Cyble, a newly discovered Android trojan called OverlayPhantom has been targeting over 180 banking, financial and cryptocurrency applications across 10 countries since May 2025. The malware is distributed through malicious URLs impersonating trusted apps, including ID Austria and TikTok.

Once installed, OverlayPhantom disguises itself as Google Play Services and abuses Android's Accessibility Service to gain device control. The trojan displays fake overlays designed to mimic legitimate applications, capturing usernames, passwords, card details and PINs. Cyble says it can execute over 30 remote commands, conduct real-time screen streaming and exfiltrate harvested credentials. Affected countries include the United States, Australia, Germany, France, Belgium, Finland, the Netherlands, Italy, Spain and the United Kingdom.