The Emergence of Herodotus: A New Threat in Android Banking Malware

Herodotus is a newly identified Android banking Trojan that employs sophisticated techniques to mimic human behavior, thereby evading detection by security systems. Discovered by ThreatFabric, this malware is marketed as Malware-as-a-Service (MaaS) by the threat actor known as K1R0 and has been observed in active campaigns primarily targeting users in Italy and Brazil. The malware's distribution often occurs through SMiShing campaigns, where victims are lured into downloading malicious applications disguised as legitimate software.

New Android Malware Herodotus Mimic Human Behaviour to Bypass Biometrics DetectionNew Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a HumanHerodotus Trojan: The Android Malware That Thinks and Types Like a Human

Once installed, Herodotus requests Accessibility Service permissions, which are crucial for its operation. It utilizes a dropper application that prompts users to enable these permissions while displaying deceptive loading screens to obscure its malicious activities. The malware can intercept SMS messages to capture two-factor authentication (2FA) codes, deploy overlay screens to steal login credentials, and conduct device takeover attacks.

New Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a Human

What distinguishes Herodotus from traditional banking Trojans is its ability to simulate human-like input behavior. It introduces random delays of 0.3 to 3 seconds between keystrokes, making automated actions appear more natural and less detectable by behavioral biometrics systems. This technique allows Herodotus to bypass fraud detection mechanisms that rely solely on typing speed or input rhythm.

Herodotus Android malware mimics human typing to evade detection

Active campaigns utilizing Herodotus have been reported in Italy, where it masquerades as an app named "Banca Sicura," and in Brazil, posing as "Modulo Seguranca Stone." The malware has also been linked to overlay pages targeting financial institutions and cryptocurrency platforms in the United States, Turkey, the United Kingdom, and Poland, indicating a potential expansion of its operational scope.

Herodotus Android malware mimics human typing to evade detection

The emergence of Herodotus highlights significant vulnerabilities in current fraud detection strategies. Traditional systems that focus on interaction tempo and keystroke dynamics may struggle to identify this new threat. Cybersecurity experts emphasize the need for layered detection approaches that analyze not only user behavior patterns but also device environment indicators to effectively combat sophisticated malware like Herodotus.

Herodotus: New Android Malware Mimics Human Behavior to Bypass Biometric Security

Experts warn that the evolution of malware like Herodotus necessitates a shift in cybersecurity strategies. As malware becomes increasingly adept at mimicking human behavior, reliance on outdated detection methods may leave users and financial institutions vulnerable to fraud. The need for advanced behavioral biometric models that can differentiate between genuine human actions and automated inputs is more critical than ever.

Herodotus Malware Targeting Android Users Behaves Like A Human To Avoid Detection

In response to the discovery of Herodotus, a spokesperson from Google stated that no apps containing this malware have been found on Google Play. They assured users that Google Play Protect is designed to automatically protect Android users against known versions of malware, even those sourced from outside the Play Store.

New Android malware lags like a human to steal money from your phone (Update: Google statement)

• “Herodotus is designed to perform device takeover while making first attempts to mimic human behaviour and bypass behaviour biometrics detection,” — ThreatFabric

New Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a Human

• “The discovery of Herodotus, yet another Device-Takeover banking Trojan in an already threat-rich landscape, shows the growing popularity of these threats amongst cybercriminals, as well as commercial efficiency of Malware-as-a-Service “business model”, as Herodotus is already announced by the threat actors as a threat to rent.” — ThreatFabric

Herodotus Android malware mimics human typing to evade detection

Herodotus represents a concerning evolution in Android banking malware, combining traditional tactics with innovative methods to evade detection. As cybercriminals continue to refine their techniques, the importance of robust cybersecurity measures that adapt to these emerging threats cannot be overstated. Financial institutions and users alike must remain vigilant and proactive in safeguarding their digital environments.

Herodotus: New Android Malware Mimics Human Behavior to Bypass Biometric Security