New Sturnus Android Trojan Quietly Captures Encrypted Chats and Hijacks Devices
- Securityish
- Threats & Incidents
Quick Summary
A new Android banking trojan named Sturnus has been identified, capable of stealing credentials and taking over devices. It specifically targets encrypted messaging apps like WhatsApp, Telegram, and Signal, posing significant risks to users’ privacy and security.
The Securityish Brief
The emergence of the Sturnus trojan highlights a growing trend in malware that targets encrypted communications, raising concerns for everyday users and organizations alike.
By capturing screen content after decryption, Sturnus can monitor private conversations, which undermines the security assurances provided by encrypted messaging platforms.
Organizations, especially those in financial sectors across Southern and Central Europe, should be aware of the potential for overlay attacks that trick users into entering sensitive information.
Understanding the Risks
Users should be vigilant about the apps they install, as Sturnus is distributed through seemingly benign applications like Google Chrome and Preemix Box.
Additionally, the malware’s ability to leverage Android’s accessibility services to capture keystrokes and UI interactions makes it particularly dangerous, as it can operate without raising immediate suspicion.
As Sturnus evolves, users and organizations must remain proactive in monitoring device security and ensuring that protective measures, such as Google Play Protect, are enabled.
Key Takeaways
- Regularly update your Android device to ensure you have the latest security patches.
- Enable Google Play Protect to help detect and prevent malware installations.
- Be cautious when downloading apps and only use trusted sources like the Google Play Store.
- Monitor your financial accounts for any unauthorized transactions or unusual activity.
- Consider using additional security measures, such as two-factor authentication, for sensitive accounts.
Key Terms & Concepts
- Sturnus: Sturnus is a banking trojan that targets Android devices to steal credentials and take over devices.
- Overlay attack: An overlay attack involves displaying a fake login screen over legitimate apps to capture user credentials.
- Accessibility services: Accessibility services in Android allow apps to interact with the user interface and can be exploited by malware to monitor user actions.
Read the original article here: https://thehackernews.com/2025/11/new-sturnus-android-trojan-quietly.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
