Archive · 25 Nov 2025
New Android Trojan Bypasses WhatsApp, Signal, Telegram Encryption
A new type of Android malware called Sturnus can bypass the encryption of apps like WhatsApp, Signal, and Telegram.
It doesn't break the encryption itself but reads messages from the screen after they are decrypted.
The malware disguises itself as legitimate apps to trick users into installing it.
Once installed, it can show fake login screens to steal banking details or use a 'Black Screen' attack to perform transactions without the user's knowledge.
The malware is also designed to stay on the phone and hide its activities if it detects that someone is trying to analyze or remove it.
Sturnus is a new Android trojan that can bypass encryption on WhatsApp, Signal, and Telegram.
It reads messages from the screen after decryption, monitoring conversations in real-time.
The malware disguises itself as legitimate apps like Google Chrome to trick users into installation.
It commits financial fraud through fake login screens and 'Black Screen' attacks.
Sturnus aggressively stays on the victim's phone, preventing uninstallation and hiding its behavior.
- Who
- Security researchers at ThreatFabric
- What
- A new Android banking trojan called Sturnus
- When
- Currently in testing phase, preparations for broader campaign underway
- Where
- Targeting financial institutions in Southern and Central Europe
- Why
- To steal banking credentials and commit financial fraud
- Malware Name
- Sturnus
- Target Apps
- WhatsApp, Signal, Telegram
- Target Regions
- Southern and Central Europe
- Disguise
- Legitimate apps like Google Chrome
- Fraud Methods
- Fake login screens, Black Screen attack
- Defensive Mechanisms
- Prevents uninstallation, hides behavior