The malware has been used in device takeover attacks in Italy and Brazil, and also for spoofing banking and crypto phishing.

When humans input passwords and user IDs into a dialog box, they do so differently from a bot or malware, which sends entire strings of alphanumeric text into the entry fields instantly.

Guess what? Malware developers have resorted to replicating this trait to foil cybersecurity systems that monitor and learn users’ typing behavior (among other usage patterns).

A new Android malware strain can now steal banking credentials by mimicking human typing patterns with random delays to evade behavioral fraud-detection systems. It incorporates parts of the Brokewell banking malware along with original code, and has been used in device takeover attacks in Italy and Brazil, according to Dutch firm ThreatFabric.

Fake overlay screens mimicking legitimate banking and cryptocurrency apps have been discovered targeting users in the US, UK, Turkey, and Poland, enabling attackers to steal login details by appearing authentic.

Dubbed Herodotus (after the eponymous Greek historian who has sometimes been called the “Father of Lies”) by its developers, the malware spreads mostly via SMS phishing links that lead to side-loading the trojan. After installation, it prompts victims to enable Android’s accessibility services, giving attackers broad control to read, click, and swipe on the device screen.

Modus operandi

Once operational, Herodotus collects a list of installed apps, then uses credential-stealing overlays for those it targets. It also logs keystrokes, intercepts one-time password messages, and can steal security pins and fingerprints.

What sets Herodotus apart is its ability to simulate human typing by adding random delays of 0.3 to 3 seconds between keystrokes. This behavior helps it bypass security systems that monitor typing speed as a sign of automated input. The malware is currently being sold as a service by its developer, known as “K1R0” in underground forums, since early September.

The trojan’s command-and-control infrastructure uses various domains connected to the developer and other criminals targeting different regions. For instance, in Italy it masquerades as an app called Banca Sicura and uses a specific subdomain, while in Brazil it appears as Modulo Seguranca Stone with a different command domain.

Researchers expect Herodotus will continue evolving and become more widely used in global cybercrime campaigns.