Deceive the Heavens to Cross the sea Published: 2024-10-01 · Archived: 2026-04-05 21:55:51 UTC The “Deceive the Heavens to Cross the sea” stratagem comes from the first chapter of the ‘Thirty-Six Stratagems’, a famous Chinese collection of tactics and techniques used in politics, war and civil life. It translates to “hide in plain sight” or “mask your true goals”. Android banking trojan actors have taken this stratagem to heart and have been very adaptable over years to new Google Play app store restrictions introduced to limit their operations. These restrictions include setting limitations on the use of certain (dangerous) app permissions, which play a big role in distributing or automating malware tactics. In this blog we will discuss the recent techniques used to spread Android banking trojans via Google Play (MITRE T1475) resulting in significant financial loss for targeted banks. We will also discuss the, sometimes forgotten, by-product of collecting contacts and keystrokes by Banking trojans, resulting in severe data leakage. In the span of only 4 months, 4 large Android families were spread via Google Play, resulting in 300.000+ infections via multiple dropper apps. A noticeable trend in the new dropper campaigns is that actors are focusing on loaders with a reduced malicious footprint in Google Play, considerably increasing the difficulties in detecting them with automation and machine learning techniques. The small malicious footprint is a result of the new Google Play restrictions (current and planned) to put limitations on the use of privacy concerning app permissions. Permissions such as Accessibility Service, which in previous campaigns was one of the core tactics abused to automate the installation process of Android banking trojans via dropper apps in Google Play. By limiting the use of these permissions, actors were forced to choose the more conventional way of installing apps, which is by asking the installation permission, with the side-effect of blending in more with legitimate apps. This is one of the core reasons of the significant success of mobile banking threat actors in sneaking into Google’s trusted app store. A second big factor behind their success is that actors have set restrictions, with mechanisms to ensure that the payload is installed only on the victim’s device and not on testing environments. To achieve this, criminals use a multitude of techniques, which range from location checks to incremental malicious updates, passing by time-based de-obfuscation and server-side emulation checks. This incredible attention dedicated to evading unwanted attention renders automated malware detection less reliable. This consideration is confirmed by the very low overall VirusTotal score of the 9 number of droppers we have investigated in this blogpost. How we help our customers ThreatFabric makes it easier than it has ever been to run a secure mobile payments business. With the most advanced threat intelligence for mobile banking, financial institutions can build a risk-based mobile security strategy and use this unique knowledge to detect fraud-by-malware on the mobile devices of customers in real-time. Together with our customers and partners, we are building an easy-to-access information system to tackle the ever-growing threat of mobile malware targeting the financial sector. We especially like to thank the Cyber Defence Alliance (CDA) for collaborating and proactively sharing knowledge and information across the financial sector to fight cyber-threats. ThreatFabric has partnerships with TIPs all over the world. If you want to request a free trial of our MTI-feed, or want to test our own MTI portal for 30 days, feel free to contact us at: sales@threatfabric.com https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 1 of 28 If you want more information on how we detect mobile malware on mobile devices, you can directly contact us at: info@threatfabric.com Appendix: IOC Brunhilda Dropper Samples App name Package name SHA-256 Two Factor Authenticator com.flowdivison a3bd136f14cc38d6647020b2632bc35f21fc643c0d3741caaf92f48df0fc6997 Protection Guard com.protectionguard.app d3dc4e22611ed20d700b6dd292ffddbc595c42453f18879f2ae4693a4d4d925a QR CreatorScanner com.ready.qrscanner.mix ed537f8686824595cb3ae45f0e659437b3ae96c0a04203482d80a3e51dd915ab Master Scanner Live com.multifuction.combine.qr 7aa60296b771bdf6f2b52ad62ffd2176dc66cb38b4e6d2b658496a6754650ad4 Brunhilda Dropper C2 URL URL hxxps://protectionguardapp[.]club hxxps://readyqrscanner[.]club hxxps://flowdivison[.]club hxxps://multifuctionscanner[.]club Anatsa Dropper Samples App name Package name SHA-256 QR Scanner 2021 com.qr.code.generate 2db34aa26b1ca5b3619a0cf26d166ae9e85a98babf1bc41f784389ccc6f54af QR Scanner com.qr.barqr.scangen d4e9a95719e4b4748dba1338fdc5e4c7622b029bbcd9aac8a1caec30b5508d PDF Document Scanner - Scan to PDF com.xaviermuches.docscannerpro2 2080061fe7f219fa0ed6e4c765a12a5bc2075d18482fa8cf27f7a090deca54c PDF Document Scanner com.docscanverifier.mobile 974eb933d687a9dd3539b97821a6a777a8e5b4d65e1f32092d5ae30991d4b PDF Document Scanner Free com.doscanner.mobile 16c3123574523a3f1fb24bbe6748e957afff21bef0e05cdb3b3e601a753b8f9 CryptoTracker cryptolistapp.app.com.cryptotracker 1aafe8407e52dc4a27ea800577d0eae3d389cb61af54e0d69b89639115d527 https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 2 of 28 Anatsa Dropper C2 URL URL hxxp://195.201.70.88/api/update hxxp://178.63.27.179/api/update hxxp://91.242.229.85/api/update hxxp://195.201.70.89/api/update Gymdrop Dropper Samples App name Package name SHA-256 Gym and Fitness Trainer com.gym.trainer.jeux 30ee6f4ea71958c2b8d3c98a73408979f8179159acccc01b6fd53ccb20579b6b Gym and Fitness Trainer com.gym.trainer.jeux b3c408eafe73cad0bb989135169a8314aae656357501683678eff9be9bcc618f Gymdrop Dropper C2 URL URL hxxps://onlinefitnessanalysis[.]com/ Malware Samples dropped Malware Family App name Package name SHA-256 Alien.A Master Scanner Live leaf.leave.exchang 74407e40e1c01e73087442bcdf3a0802121c4263ab67122674d9d09b3edf85 Alien.A Gym and Fitness Trainer gesture.enlist.say e8cbcc34af3bd352767b7a9270dd684a50da2e68976a3712675526a7398550 Anatsa.A PDF AI : TEXT RECOGNIZER com.uykxx.noazg d42e0d3db3662e809af3198da67fdbd46d5c2a1052b5945401e4cdd06c1977 Hydra.C QR CreatorScanner com.cinnamon.equal 9ab66c1b7db44abaa53850a3d6a9af36c8ad603dab6900caba592497f632349 Ermac.A QR CreatorScanner com.tag.right fd7e7e23db5f645db9ed47a5d36e7cf57ca2dbdf46a37484eafa1e04f657bf02 Appendix: Targeted apps Alien.A Targets https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 3 of 28 Package Name App Name com.kubi.kucoin KuCoin: Bitcoin Exchange & Crypto Wallet com.abanca.bm.pt ABANCA - Portugal com.bitfinex.mobileapp Bitfinex com.changelly.app Changelly: Buy Bitcoin BTC & Fast Crypto Exchange es.liberbank.cajasturapp Banca Digital Liberbank wit.android.bcpBankingApp.millennium Millenniumbcp es.openbank.mobile Openbank – banca móvil pt.bctt.appbctt Banco CTT com.exictos.mbanka.bic Banco BIC, SA com.kraken.trade Pro: Advanced Bitcoin & Crypto Trading com.plunien.poloniex Poloniex Crypto Exchange com.kutxabank.android Kutxabank com.bitpay.wallet BitPay – Secure Bitcoin Wallet com.binance.dev Binance - Buy & Sell Bitcoin Securely com.bbva.netcash BBVA Net Cash ES & PT com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet com.rsi.Colonya Colonya Caixa Pollença com.transferwise.android TransferWise Money Transfer pt.bancobpi.mobile.fiabilizacao BPI APP com.bancamarch.bancamovil Banca March com.mycelium.wallet Mycelium Bitcoin Wallet com.cajasur.android Cajasur com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa net.bitbay.bitcoin Bitcoin & Crypto Exchange - BitBay es.evobanco.bancamovil EVO Banco móvil com.bankinter.portugal.bmb Bankinter Portugal com.google.android.gm Gmail pt.bancobest.android.mobilebanking Best Bank com.wavesplatform.wallet Waves.Exchange net.bitstamp.app Bitstamp – Buy & Sell Bitcoin at Crypto Exchange https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 4 of 28 Package Name App Name es.bancosantander.apps Santander com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar com.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform com.grupocajamar.wefferent Grupo Cajamar com.bankinter.launcher Bankinter Móvil es.cm.android Bankia pt.novobanco.nbapp NB smart app com.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL es.ibercaja.ibercajaapp Ibercaja pt.santandertotta.mobileempresas Santander Empresas es.pibank.customers Pibank piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum com.indra.itecban.mobile.novobanco NBapp Spain com.mediolanum Banco Mediolanum España com.android.vending Google Play com.bbva.mobile.pt BBVA Portugal com.squareup.cash Cash App es.caixagalicia.activamovil ABANCA- Banca Móvil es.univia.unicajamovil UnicajaMovil org.electrum.electrum Electrum Bitcoin Wallet app.wizink.es WiZink, tu banco senZillo com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email cgd.pt.caixadirectaparticulares Caixadirecta com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar com.mail.mobile.android.mail mail.com mail com.imaginbank.app imaginBank - Your mobile bank es.caixaontinyent.caixaontinyentapp Caixa Ontinyent www.ingdirect.nativeframe ING España. Banca Móvil eu.atlantico.bancoatlanticoapp MY ATLANTICO com.bbva.bbvacontigo BBVA Spain https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 5 of 28 Package Name App Name com.citi.mobile.ccc CitiManager – Corporate Cards ca.mobile.explorer CA Mobile com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast com.rsi ruralvía es.cecabank.ealia2103appstore UniPay Unicaja wit.android.bcpBankingApp.activoBank ActivoBank com.indra.itecban.triodosbank.mobile.banki - es.lacaixa.mobile.android.newwapicon CaixaBank com.db.pbc.mibanco Mi Banco db com.targoes_prod.bad TARGOBANK - Banca a distancia Ermac.A Targets Package Name App Name eu.inmite.prj.kb.mobilbank Mobilni Banka com.greater.Greater Greater Bank uk.co.tsb.newmobilebank TSB Mobile Banking org.microemu.android.model.common.VTUserApplicationLINKMB Link Celular es.lacaixa.mobile.android.newwapicon CaixaBank com.IngDirectAndroid ING France es.bancosantander.apps Santander com.ocito.cdn.activity.creditdunord Crédit du Nord pour Mobile pl.ideabank.mobilebanking Idea Bank PL gt.com.bi.bienlinea Bi en Línea org.banking.bsa.businessconnect BankSA Business App pl.envelobank.aplikacja EnveloBank net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank com.msf.kbank.mobile Kotak - 811 & Mobile Banking au.com.ingdirect.android ING Australia Banking com.getingroup.mobilebanking Getin Mobile au.com.amp.myportfolio.android My AMP com.magiclick.odeabank Odeabank https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 6 of 28 Package Name App Name com.mtel.androidbea BEA 東亞銀行 eu.eleader.mobilebanking.pekao.firm PekaoBiznes24 org.banking.stg.businessconnect St.George Business App softax.pekao.powerpay PeoPay com.rsi ruralvía my.com.hsbc.hsbcmalaysia HSBC Malaysia com.td TD Canada org.banksa.bank BankSA Mobile Banking org.bom.bank Bank of Melbourne Mobile Banking com.zoluxiones.officebanking Banco Santander Perú S.A. com.pcfinancial.mobile Simplii Financial es.evobanco.bancamovil EVO Banco móvil com.latuabancaperandroid Intesa Sanpaolo Mobile com.fusion.beyondbank Beyond Bank Australia com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking com.unicredit Mobile Banking UniCredit com.tarjetanaranja.emisor.serviciosClientes.appTitulares Naranja au.com.newcastlepermanent NPBS Mobile Banking au.com.suncorp.SuncorpBank Suncorp Bank de.traktorpool tractorpool hu.cardinal.erste.mobilapp Erste Business MobilBank au.com.bankwest.mobile Bankwest it.popso.SCRIGNOapp SCRIGNOapp de.dkb.portalapp DKB-Banking pe.com.interbank.mobilebanking Interbank APP it.copergmps.rt.pf.android.sp.bmps Banca MPS de.consorsbank Consorsbank com.isis_papyrus.raiffeisen_pay_eyewdg Raiffeisen ELBA de.fiducia.smartphone.android.banking.vr VR Banking Classic com.pozitron.iscep İşCep - Mobile Banking https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 7 of 28 Package Name App Name wit.android.bcpBankingApp.millenniumPL Bank Millennium es.ibercaja.ibercajaapp Ibercaja alior.bankingapp.android Usługi Bankowe com.krungsri.kma KMA it.ingdirect.app ING Italia com.mobillium.papara Papara de.adesso_mobile.secureapp.netbank SecureApp netbank com.nearform.ptsb permanent tsb com.konylabs.cbplpat Citi Handlowy com.lynxspa.bancopopolare YouApp tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE com.appfactory.tmb Teachers Mutual Bank au.com.mebank.banking ME Bank com.kasikorn.retail.mbanking.wap K PLUS com.infrasofttech.MahaBank Maha Mobile com.pttfinans PTTBank es.univia.unicajamovil UnicajaMovil au.com.commbank.commbiz.prod CommBiz my.com.maybank2u.m2umobile Maybank2u MY es.pibank.customers Pibank de.ingdiba.bankingapp ING Banking to go com.fusion.banking Bank Australia app com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa pegasus.project.ebh.mobile.android.bundle.mobilebank George Magyarország au.com.rams.RAMS myRAMS com.teb CEPTETEB eu.netinfo.colpatria.system Scotiabank Colpatria de.santander.presentation Santander Banking es.openbank.mobile Openbank – banca móvil pl.raiffeisen.nfc Mobilny Portfel https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 8 of 28 Package Name App Name pt.novobanco.nbapp NB smart app uk.co.metrobankonline.mobile.android.production Metro Bank com.tmobtech.halkbank Halkbank Mobil de.mobile.android.app mobile.de – Germany‘s largest car market net.bnpparibas.mescomptes Mes Comptes BNP Paribas com.mercadolibre Mercado Libre: compra fácil y rápido uk.co.mbna.cardservices.android MBNA - Card Services App hu.cardinal.cib.mobilapp CIB Business Online fr.creditagricole.androidapp Ma Banque jp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ org.banking.bom.businessconnect Bank of Melbourne Business App pl.ing.mojeing Moje ING mobile pl.pkobp.ipkobiznes iPKO biznes com.usbank.mobilebanking U.S. Bank - Inspired by customers pl.pkobp.iko IKO com.anz.transactive.global ANZ Transactive - Global com.bankofqueensland.boq BOQ Mobile com.ingbanktr.ingmobil ING Mobil com.tdbank TD Bank (US) com.scb.phone SCB EASY com.Version1 PNB ONE net.garagecoders.e_llavescotiainfo ScotiaMóvil nz.co.asb.asbmobile ASB Mobile Banking com.finanteq.finance.bgz BNP Paribas GOMobile com.woodforest Woodforest Mobile Banking ro.btrl.mobile Banca Transilvania uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking com.todo1.mobile Bancolombia App Personas com.uy.itau.appitauuypf Itaú Uruguay com.key.android KeyBank Mobile https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 9 of 28 Package Name App Name it.bnl.apps.banking BNL au.com.cua.mb CUA Mobile Banking com.ykb.android Yapı Kredi Mobile ktbcs.netbank Krungthai NEXT com.santander.bpi Santander Private Banking posteitaliane.posteapp.apppostepay Postepay uk.co.tescomobile.android Tesco Mobile es.ceca.cajalnet Cajalnet com.scotiabank.banking Scotiabank Mobile Banking it.nogood.container UBI Banca pl.noblebank.mobile Noble Mobile com.suntrust.mobilebanking SunTrust Mobile App pl.eurobank2 eurobank mobile 2.0 com.mobileloft.alpha.droid myAlpha Mobile com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking pl.millennium.corpApp Bank Millennium for Companies au.com.hsbc.hsbcaustralia HSBC Australia com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale org.westpac.col Westpac Corporate Mobile au.com.macquarie.banking Macquarie Mobile Banking finansbank.enpara Enpara.com Cep Şubesi org.stgeorge.bank St.George Mobile Banking com.mcom.firstcitizens First Citizens Mobile Banking fr.laposte.lapostemobile La Poste - Services Postaux es.bancosantander.empresas Santander Empresas fr.lcl.android.customerarea Mes Comptes - LCL fr.banquepopulaire.cyberplus Banque Populaire uk.co.santander.santanderUK Santander Mobile Banking com.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net pl.fakturownia Fakturownia.pl https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 10 of 28 Package Name App Name pt.bancobpi.mobile.fiabilizacao BPI APP de.commerzbanking.mobil Commerzbank Banking - The app at your side de.comdirect.android comdirect mobile App com.kutxabank.android Kutxabank pt.santandertotta.mobileparticulares Santander Particulares es.caixageral.caixageralapp Banco Caixa Geral España com.itau.empresas Itaú Empresas: Controle e Gestão do seu Negócio wit.android.bcpBankingApp.millennium Millenniumbcp com.sbi.SBIFreedomPlus Yono Lite SBI - Mobile Banking fr.oney.mobile.mescomptes Oney France pl.bzwbk.bzwbk24 Santander mobile com.vancity.mobileapp Vancity com.comarch.security.mobilebanking ING Business com.snapwork.hdfc HDFC Bank MobileBanking es.caixagalicia.activamovil ABANCA- Banca Móvil tsb.mobilebanking TSB Bank Mobile Banking com.zellepay.zelle Zelle ma.gbp.pocketbank Pocket Bank de.postbank.finanzassistent Postbank Finanzassistent com.bendigobank.mobile Bendigo Bank es.liberbank.cajasturapp Banca Digital Liberbank hu.bb.mobilapp Budapest Bank Mobil App com.pnc.ecommerce.mobile PNC Mobile eu.atlantico.bancoatlanticoapp MY ATLANTICO pl.bps.bankowoscmobilna BPS Mobilnie eu.unicreditgroup.hvbapptan HVB Mobile Banking com.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking pl.aliorbank.aib Alior Mobile com.mfoundry.mb.android.mb_136 People’s United Bank Mobile au.com.ubank.internetbanking UBank Mobile Banking https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 11 of 28 Package Name App Name de.number26.android N26 — The Mobile Bank cz.csob.smartbanking ČSOB Smartbanking mobi.societegenerale.mobile.lappli L’Appli Société Générale com.vakifbank.mobile VakıfBank Mobil Bankacılık com.anz.android.gomoney ANZ Australia mbanking.NBG NBG Mobile Banking pl.bph BusinessPro Lite com.finanteq.finance.ca CA24 Mobile com.quoine.quoinex.light Liquid by Quoineライト版（リキッドバイコ イン） -ビットコインなどの仮想通貨取引 所 enterprise.com.anz.shield ANZ Shield pl.bzwbk.ibiznes24 iBiznes24 mobile tr.com.hsbc.hsbcturkey HSBC Turkey com.kuveytturk.mobil Kuveyt Türk com.ziraat.ziraatmobil Ziraat Mobile com.targo_prod.bad TARGOBANK Mobile Banking au.com.nab.mobile NAB Mobile Banking com.samba.mb SambaMobile org.westpac.bank Westpac Mobile Banking pl.ifirma.ifirmafaktury IFIRMA - Darmowy Program do Faktur com.rbc.mobile.android RBC Mobile com.tideplatform.banking Tide - Smart Mobile Banking com.sbi.SBAnywhereCorporate SBI Anywhere Corporate hu.mkb.mobilapp MKB Mobilalkalmazás com.todo1.davivienda.mobileapp Davivienda Móvil jp.co.netbk 住信SBIネット銀行 com.navyfederal.android Navy Federal Credit Union com.infrasofttech.CentralBank Cent Mobile com.konylabs.capitalone Capital One® Mobile es.cm.android Bankia https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 12 of 28 Package Name App Name pl.mbank mBank PL com.wf.wellsfargomobile Wells Fargo Mobile gr.winbank.mobilenext Winbank Mobile com.westernunion.moneytransferr3app.es Western Union ES - Send Money Transfers Quickly com.snapwork.IDBI IDBI Bank GO Mobile+ com.commbank.netbank CommBank mx.bancosantander.supermovil Santander móvil com.rbs.mobile.android.natwest NatWest Mobile Banking it.carige Carige Mobile com.usaa.mobile.android.usaa USAA Mobile eu.eleader.mobilebanking.pekao Pekao24Makler Anatsa.A Targets Package Name App Name uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking com.chase.sig.android Chase Mobile com.wf.wellsfargomobile Wells Fargo Mobile com.citi.citimobile Citi Mobile® com.konylabs.capitalone Capital One® Mobile com.infonow.bofa Bank of America Mobile Banking com.jpm.sig.android J.P. Morgan Mobile com.usbank.mobilebanking U.S. Bank - Inspired by customers com.truist.mobile Truist Mobile - Banking Made Better com.pnc.ecommerce.mobile PNC Mobile com.tdbank TD Bank (US) com.schwab.mobile Schwab Mobile com.statestreetbank.grip State Street Bank us.hsbc.hsbcus HSBC US com.citizensbank.androidapp Citizens Bank Mobile Banking com.syf.synchronybank Synchrony Bank https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 13 of 28 Package Name App Name com.creditonebank.mobile Credit One Bank Mobile com.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking com.fidelity.android Fidelity Investments us.current.android Earn Cash Reward: Make Money Playing Games & Music com.robinhood.android Robinhood - Investment & Trading, Commission-free com.moneylion MoneyLion: Mobile Banking App com.sablemoney.sableapp.prod Sable com.virginmoney.uk.mobile.android Virgin Money Mobile Banking com.monitise.client.android.yorkshire Yorkshire Bank Mobile Banking com.monitise.client.android.clydesdale Clydesdale Bank Mobile Banking com.algorand.android Algorand Wallet com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet co.mona.android Crypto.com - Buy Bitcoin Now com.monese.monese.live Monese - Mobile Money Account for UK & Europe com.binance.dev Binance - Buy & Sell Bitcoin Securely com.danskebank.mobilebank3.uk Mobile Bank UK – Danske Bank com.rbs.mobile.android.ubn Ulster Bank NI Mobile Banking com.rbs.mobile.android.natwest NatWest Mobile Banking com.rbs.mobile.android.natwestoffshore NatWest International com.plunien.poloniex Poloniex Crypto Exchange com.wallet.crypto.trustapp Trust: Crypto & Bitcoin Wallet com.cooperativebank.bank The Co-operative Bank uk.co.metrobankonline.mobile.android.production Metro Bank com.starlingbank.android Starling Bank - Better Mobile Banking io.metamask MetaMask - Buy, Send and Swap Crypto co.uk.getmondo Monzo Bank com.binance.us Binance.US com.kraken.invest.app Kraken - Buy Bitcoin & Crypto com.blockfolio.blockfolio Blockfolio - Bitcoin and Cryptocurrency Tracker com.gemini.android.app Gemini: Buy Bitcoin Instantly https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 14 of 28 Package Name App Name com.okinc.okcoin.intl Okcoin - Buy & Trade Bitcoin, Ethereum, & Crypto com.barclays.android.barclaysmobilebanking Barclays com.tideplatform.banking Tide - Smart Mobile Banking com.grppl.android.shell.halifax Halifax: the banking app that gives you extra com.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side com.usaa.mobile.android.usaa USAA Mobile com.blockfi.mobile BlockFi - Buy, Earn, Borrow Crypto com.marcus.android Marcus by Goldman Sachs® com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking org.penfed.mobile.banking PenFed com.navyfederal.android Navy Federal Credit Union com.stash.stashinvest Stash: Invest, Bank, Save com.regions.mobbanking Regions Bank com.varomoney.bank Varo Bank: Mobile Banking com.current.app Current - Modern Banking com.huntington.m Huntington Mobile com.clairmail.fth Fifth Third Mobile Banking com.mint Mint: Personal Finance Manager piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum com.q2e.texasdowcreditunion5004401st.mobile.production TDECU Digital Banking pr.com.firstbank FirstBank Digital Banking App com.oneazcu.banking OneAZ Mobile Banking com.axos.udb Axos Bank® com.etrade.mobilepro.activity E*TRADE: Invest. Trade. Save. org.suncoast.mobile Suncoast SunMobile com.firsttech.firsttech First Tech Federal CU org.ncsecu.mobile SECU org.ncsecu.mobile SECU com.softek.ofxclmobile.warrenfcu Blue FCU Mobile Banking App com.bethpage.bethpage Bethpage Mobile Banking https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 15 of 28 Package Name App Name com.myoccu.mobile MyOCCU Mobile Banking com.ifs.banking.fiid3160 Tru2Go Truliant Mobile Banking com.desertschools.mobilebanking Desert Financial Mobile com.nymfcu.nymfcu NYMCU Mobile Banking com.softek.ofxclmobile.summitcu Summit Credit Union Mobile com.fi7453.godough PFFCU Mobile Banking com.cuamerica.cuamerica Credit Union of America com.ifs.banking.fiid3337 Arizona Federal Mobile Banking com.ksfcu.ksfcu Valley Strong DataMobile com.ifs.mobilebanking.fiid9094 Service CU Mobile Banking com.scottcreditunion5029.mobile Scott Credit Union com.socalcu.socalcu CU SoCal Mobile Banking com.q2e.unitedfcu5017android.ufcu.uwnmobile United Federal Credit Union com.credituniononecu.credituniononecu NEW - Credit Union One Michigan mobile.dcfcu.org DCFCU Mobile com.ifs.mobilebanking.fiid3919 Associated Credit Union Mobile com.ifs.banking.fiid1359 WPCU Mobile Banking com.growfinancialfcu.growfinancialfcu Grow Mobile Banking com.nexowallet Nexo - Crypto Banking Account com.investvoyager Voyager: Crypto Made Simple com.mobileloft.alpha.droid myAlpha Mobile mbanking.NBG NBG Mobile Banking com.vivawallet.business Viva Wallet gr.winbank.mobilenext Winbank Mobile com.EurobankEFG Eurobank Mobile App io.sperax.wallet Sperax Play ru.sberbankmobile Сбербанк Онлайн ru.otpbank.mobile ОТП Банк ru.letobank.Prometheus Почта Банк ge.lb.mobilebank Liberty https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 16 of 28 Package Name App Name com.idamob.tinkoff.android Tinkoff ru.bankuralsib.mb.android Мобильный банк УРАЛСИБ gr.nbg.go4more go4more com.ubanksu UBANK ru.vtb24.mobilebanking.android VTB-Online com.mtbank Мой банк com.columbiabank3685.mobile.production Columbia Bank com.capital.etf.trade Investments - Capital.com ch.raiffeisen.twint Raiffeisen TWINT ch.postfinance.twint.android PostFinance TWINT com.csg.creditsuisse.twint Credit Suisse TWINT – mobile payment app ch.postfinance.android PostFinance Mobile com.csg.cs.dnmb Credit Suisse Direct com.ubs.swidK2Y.android UBS Access – secure login for digital banking com.ubs.swidKXJ.android UBS Mobile Banking: E-Banking and mobile pay com.neonbanking.app neon - your account app ch.raiffeisen.android Raiffeisen E-Banking com.flowbank.client FlowBank ch.bankcler.zak Bank Cler Zak com.axa.android.smartclaims.ch MyAXA CH ch.zkb.slv.mobile.client.android eBanking Mobile com.swissborg.android SwissBorg: Invest in Crypto ch.zkb.twint ZKB TWINT ch.zkb.frankly frankly. Pillar 3a – Private pension ch.bcv.mobile.android BCV Mobile at.rsg.pfp Mein ELBA-App at.erstebank.george George Österreich at.erstebank.securityapp s Identity com.bawagpsk.bawagpsk BAWAG PSK klar – Mobile Banking App com.bankaustria.android.olb Bank Austria MobileBanking https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 17 of 28 Package Name App Name at.tmobile.android.myt Mein Magenta (AT) com.bitpanda.bitpanda Bitpanda - Buy Bitcoin in minutes at.volksbank.volksbankmobile Volksbank hausbanking at.ing.diba.client.onlinebanking ING Banking Austria com.easybank.easybank easybank App at.oberbank.mbanking Oberbank de.xcom.flatexat flatex AT com.cardcomplete.completecontrol complete Control at.bank99.meine.meine meine99 Online Banking at.bks.mbanking BKS Bank Österreich at.racon.mandantvkb VKB CONNECT com.csiweb.digitalbanking.bk0617 Viking Bank Mobile com.csiweb.digitalbanking.bk0710 Minnesota National Bank dk.bec.android.mb1.b00369.prod Spar Nord Mobilbank dk.bec.android.mb1.b00020.prod AL-Bank dk.jyskebank.drb Jyske Bank dk.landbobanken.drb Ringkjøbing Landbobank og Nordjyske Bank dk.bec.android.mb1.b00019.prod Vestjysk Bank dk.nordea.mobilebank Nordea Mobile - Denmark dk.sydbank.drb Sydbanks Mobilbank Privat com.resurs.rbapp Resurs Bank com.danskebank.mobilebank3.dk NY mobilbank DK - Danske Bank nz.co.cooperativebank The Co-operative Bank (NZ) nz.co.anz.android.mobilebanking ANZ goMoney New Zealand nz.co.asb.asbmobile ASB Mobile Banking nz.co.asb.asbmobile ASB Mobile Banking nz.co.kiwibank.mobile Kiwibank Mobile Banking nz.co.westpac Westpac One (NZ) Mobile Banking com.commbank.netbank CommBank au.com.nab.mobile NAB Mobile Banking https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 18 of 28 Package Name App Name com.anz.android.gomoney ANZ Australia org.westpac.bank Westpac Mobile Banking com.bendigobank.mobile Bendigo Bank au.com.ingdirect.android ING Australia Banking org.stgeorge.bank St.George Mobile Banking au.com.bankwest.mobile Bankwest com.coinspot.app CoinSpot - Buy & Sell Bitcoin org.banksa.bank BankSA Mobile Banking au.com.heritage.app Heritage Mobile Banking org.bom.bank Bank of Melbourne Mobile Banking au.com.cua.mb CUA Mobile Banking au.com.swyftx Swyftx Cryptocurrency Exchange - Buy, Sell & Trade com.citibank.mobile.au Citibank Australia au.com.mebank.banking ME Bank au.com.newcastlepermanent NPBS Mobile Banking com.fusion.beyondbank Beyond Bank Australia com.bankofqueensland.boq BOQ Mobile com.adcb.cbgdigi ADCB Hayyak: Start your banking relationship now! com.cbd.mobile CBD com.dib.app DIB MOBILE com.mashreq.NeoApp Mashreq Neo - Bank easy com.adcb.bank ADCB enbd.mobilebanking Emirates NBD com.fab.personalbanking FAB Mobile com.adib.mobile ADIB Mobile Banking App com.rak RAKBANK Digital Banking com.adib.smartmoney smartbanking by ADIB com.alhilal.hayyak Ahlan by Al Hilal Bank com.kubi.kucoin KuCoin: Bitcoin Exchange & Crypto Wallet com.mbc.anb.keystore ANB Mobile~ Arab National Bank https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 19 of 28 Package Name App Name com.phonepe.app PhonePe: UPI, Recharge, Investment, Insurance com.rainmanagement.rain Rain: Buy & Sell Bitcoin com.BanqueMisr.MobileBanking BM Online com.riyadbank.strategic RiyadBank Mobile sa.liv.android Liv. KSA - Digital Banking com.alahli.mobile.android SNB AlAhli Mobile com.alrajhiretailapp Al Rajhi Mobile com.samba.mb SambaMobile com.sabb.mobilebanking SABBMobile com.bsffm FransiMobile com.alinma.retail.mobile Alinma Bank com.saib.banking.mobile.android SAIB com.slsp.mtoken SLSP mToken sk.slsp.georgego George Go Slovensko bank.sk365.app 365.bank sk.tb.ib.tatraandroid Tatra banka sk.csob.smarttoken CSOB SmartToken com.zentity.sbank.csobsk SmartBanking sk.vub.mobile VÚB Mobile Banking sk.tb.emv.mobile Čítačka sk.raiffeisen.ib.androidwrapper Raiffeisen Bank SK cz.homecredit.hcsk Home Credit SK com.zentity.pabk Poštová banka hr.asseco.android.jimba.mUCI.sk SmartBanking SK sk.mbank mBank SK sk.primabanka.penazenka Peňaženka com.firstdirect.bankingonthego first direct com.revolut.revolut Revolut - Get more from your money com.outsystemsenterprise.thinkmoneyprod.ThinkMoney thinkmoney com.vanso.gtbankapp GTBank https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 20 of 28 Package Name App Name com.suntrust.mobilebanking SunTrust Mobile App Hydra.C Targets Package Name App Name com.netflix.mediaclient Netflix eu.inmite.prj.kb.mobilbank Mobilni Banka com.bitfinex.mobileapp Bitfinex com.google.android.gm Gmail es.lacaixa.mobile.android.newwapicon CaixaBank co.com.bbva.mb BBVA Colombia com.albarakaapp Albaraka Mobile Banking com.indra.itecban.triodosbank.mobile.banki - es.bancosantander.apps Santander pl.ideabank.mobilebanking Idea Bank PL pl.envelobank.aplikacja EnveloBank net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank com.ambank.ambankonline AmOnline com.liberty.jaxx Jaxx Liberty: Blockchain Wallet com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email pl.int.poczta INT Poczta com.bitcoin.mwallet Bitcoin Wallet com.cleverlance.csas.servis24 SERVIS 24 Mobilni banka com.getingroup.mobilebanking Getin Mobile org.electrum.electrum Electrum Bitcoin Wallet com.magiclick.odeabank Odeabank com.akbank.android.apps.akbank_direkt Akbank cz.rb.app.smartphonebanking Mobilní eKonto Raiffeisenbank com.db.pwcc.dbmobile Deutsche Bank Mobile com.avuscapital.trading212 Trading 212 - Stocks, ETFs, Forex, Gold softax.pekao.powerpay PeoPay com.binance.dev Binance - Buy & Sell Bitcoin Securely https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 21 of 28 Package Name App Name com.rsi ruralvía com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar huawei.settings.pin - com.denizbank.mobildeniz MobilDeniz com.grupoavalav1.bancamovil AV Villas App my.com.hsbc.hsbcmalaysia HSBC Malaysia eu.eleader.mobilebanking.pekao Pekao24Makler com.bcp.bank.bcp Banca Móvil BCP com.zoluxiones.officebanking Banco Santander Perú S.A. com.indra.itecban.mobile.novobanco NBapp Spain es.evobanco.bancamovil EVO Banco móvil com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking samsung.settings.pin - com.grupocajamar.wefferent Grupo Cajamar com.samsung.android.email.provider Samsung Email com.clairmail.fth Fifth Third Mobile Banking com.hittechsexpertlimited.hitbtc HitBTC – Bitcoin Trading and Crypto Exchange de.dkb.portalapp DKB-Banking io.totalcoin.wallet Bitcoin Wallet Totalcoin - Buy and Sell Bitcoin pe.com.interbank.mobilebanking Interbank APP cz.fio.sb2 Fio Smartbanking CZ es.caixaontinyent.caixaontinyentapp Caixa Ontinyent de.fiducia.smartphone.android.banking.vr VR Banking Classic com.polehin.android Bitcoin Wallet - Buy BTC com.pozitron.iscep İşCep - Mobile Banking com.cajaingenieros.android.bancamovil Caja de Ingenieros Banca MÓVIL wit.android.bcpBankingApp.millenniumPL Bank Millennium es.ibercaja.ibercajaapp Ibercaja alior.bankingapp.android Usługi Bankowe pl.interia.poczta_next Nowa Poczta Interia https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 22 of 28 Package Name App Name com.mobillium.papara Papara com.uphold.wallet Uphold - Trade, Invest, Send Money For Zero Fees pl.cinkciarz Currency Exchange Conotoxia com.nearform.ptsb permanent tsb com.db.mm.norisbank norisbank App com.konylabs.cbplpat Citi Handlowy tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE cz.csob.smartbanking.era Smartbanking PS com.citi.citimobile Citi Mobile® pl.onet.mail Onet Poczta - e-mail app com.cooperativebank.bank The Co-operative Bank cz.equabank.mobilebanking Equa bank com.pttfinans PTTBank es.univia.unicajamovil UnicajaMovil com.garanti.cepsubesi Garanti BBVA Mobile my.com.maybank2u.m2umobile Maybank2u MY cz.seznam.email Email.cz es.pibank.customers Pibank com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet de.ingdiba.bankingapp ING Banking to go com.bancodebogota.bancamovil Banco de Bogotá com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa com.teb CEPTETEB eu.netinfo.colpatria.system Scotiabank Colpatria com.btcturk.pro BtcTurk PRO - Bitcoin Al-Sat com.citibanamex.banamexmobile Citibanamex Móvil io.cex.app.prod CEX.IO Cryptocurrency Exchange com.plunien.poloniex Poloniex Crypto Exchange pl.raiffeisen.nfc Mobilny Portfel es.openbank.mobile Openbank – banca móvil https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 23 of 28 Package Name App Name uk.co.metrobankonline.mobile.android.production Metro Bank com.tmobtech.halkbank Halkbank Mobil uk.co.mbna.cardservices.android MBNA - Card Services App pl.wp.wppoczta WP Poczta pl.ing.mojeing Moje ING mobile com.citibank.CitibankMY Citibank MY pl.pkobp.iko IKO pl.wp.pocztao2 Poczta o2 com.ingbanktr.ingmobil ING Mobil com.tdbank TD Bank (US) om.instagram.android - cash.klever.blockchain.wallet Klever Wallet: Buy Bitcoin, Ethereum, Tron, Crypto com.finansbank.mobile.cepsube QNB Finansbank Mobile Banking com.myetherwallet.mewwallet MEW wallet – Ethereum wallet com.finanteq.finance.bgz BNP Paribas GOMobile com.moneybookers.skrillpayments.neteller NETELLER - fast, secure and global money transfers com.grppl.android.shell.halifax Halifax: the banking app that gives you extra cz.mbank mBank CZ com.grupoavaloc1.bancamovil Banco de Occidente Móvil cz.fio.android.smartbroker Fio Smartbroker com.todo1.mobile Bancolombia App Personas uk.co.hsbc.hsbcukmobilebanking HSBC UK Mobile Banking com.ubercab Uber - Request a ride com.Bither.one Bither com.electroneum.mobile Electroneum com.ykb.android Yapı Kredi Mobile com.alibaba.aliexpresshd AliExpress - Smarter Shopping, Better Living uk.co.tescomobile.android Tesco Mobile com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar com.amazon.mShop.android.shopping Amazon Shopping - Search, Find, Ship, and Save https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 24 of 28 Package Name App Name pl.nestbank.nestbank Nest Bank nowy pl.noblebank.mobile Noble Mobile com.suntrust.mobilebanking SunTrust Mobile App app.wizink.es WiZink, tu banco senZillo co.bitx.android.wallet Luno: Buy Bitcoin, Ethereum and Cryptocurrency com.grppl.android.shell.BOS Bank of Scotland Mobile Banking: secure on the go cz.csob.ceb ČSOB CEB Mobile com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale finansbank.enpara Enpara.com Cep Şubesi eu.eleader.mobilebanking.invest plusbank24 es.bancosantander.empresas Santander Empresas com.bitpay.wallet BitPay – Secure Bitcoin Wallet com.okinc.okex.gp OKEx - Bitcoin/Crypto Trading Platform uk.co.santander.santanderUK Santander Mobile Banking com.comarch.mobile.banking.bgzbnpparibas.biznes Mobile BiznesPl@net tr.gov.turkiye.edevlet.kapisi e-Devlet Kapısı cz.csas.georgego George Česká spořitelna com.grppl.android.shell.CMBlloydsTSB73 Lloyds Bank Mobile Banking: by your side de.commerzbanking.mobil Commerzbank Banking - The app at your side com.mail.mobile.android.mail mail.com mail com.discoverfinancial.mobile Discover Mobile de.comdirect.android comdirect mobile App es.santander.Criptocalculadora Criptocalculadora com.kutxabank.android Kutxabank com.targoes_prod.bad TARGOBANK - Banca a distancia cz.airbank.android My Air pe.pichincha.bm APP Banco Pichincha Perú com.bbva.netcash BBVA Net Cash: ES & PT com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast com.android.vending Google Play https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 25 of 28 Package Name App Name pl.bzwbk.bzwbk24 Santander mobile com.bbva.bbvacontigo BBVA Spain payumoney.merchantap - com.comarch.security.mobilebanking ING Business us.zoom.videomeetings ZOOM Cloud Meetings com.bbva.nxt_peru BBVA Perú   com.Plus500 Plus500: CFD Online Trading on Forex and Stocks com.thanksmister.bitcoin.localtrader Local Trader for LocalBitcoins com.ubercab.eats Uber Eats: Food Delivery com.bancocajasocial.geolocation Banco Caja Social Móvil es.caixagalicia.activamovil ABANCA- Banca Móvil de.postbank.finanzassistent Postbank Finanzassistent tsb.mobilebanking TSB Bank Mobile Banking es.liberbank.cajasturapp Banca Digital Liberbank com.yoox YOOX - Fashion, Design and Art com.bitmarket.trader Aplikacja Bitmarket mobile.santander.de Santander Mobile Banking com.pnc.ecommerce.mobile PNC Mobile pl.bps.bankowoscmobilna BPS Mobilnie com.btcturk BtcTurk Bitcoin Borsası com.bankinter.launcher Bankinter Móvil eu.unicreditgroup.hvbapptan HVB Mobile Banking pl.sgb.wallet PORTFEL SGB com.bankia.wallet Bankia Wallet com.cimbmalaysia CIMB Clicks Malaysia com.whatsapp WhatsApp Messenger com.konylabs.HongLeongConnect Hong Leong Connect Mobile Banking net.bitstamp.app Bitstamp – Buy & Sell Bitcoin at Crypto Exchange pl.aliorbank.aib Alior Mobile com.facebook.katana Facebook https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 26 of 28 Package Name App Name cz.csob.smartbanking ČSOB Smartbanking com.vakifbank.mobile VakıfBank Mobil Bankacılık com.mediolanum Banco Mediolanum España com.kraken.trade Pro: Advanced Bitcoin & Crypto Trading com.ally.MobileBanking Ally Mobile pe.com.scotiabank.blpm.android.client Scotiabank Perú pl.bph BusinessPro Lite hr.asseco.android.jimba.mUCI.cz Smart Banking com.cajasur.android Cajasur com.finanteq.finance.ca CA24 Mobile cz.moneta.smartbanka Smart Banka es.cecabank.ealia2103appstore UniPay Unicaja tr.com.hsbc.hsbcturkey HSBC Turkey com.kuveytturk.mobil Kuveyt Türk com.ebay.mobile eBay: Buy, sell, and save money on home essentials com.ziraat.ziraatmobil Ziraat Mobile com.targo_prod.bad TARGOBANK Mobile Banking com.barclaycardus Barclays US cz.kb.mba.business Mobilní banka Business com.todo1.davivienda.mobileapp Davivienda Móvil hr.asseco.android.jimba.mUCI.sme.cz Business Smart Banking com.fibabanka.Fibabanka.mobile Fibabanka Mobile com.konylabs.capitalone Capital One® Mobile samsung.settings.pass - www.ingdirect.nativeframe ING España. Banca Móvil com.infonow.bofa Bank of America Mobile Banking com.nanooqit.economiaemail Centrum.cz mail de.sdvrz.ihb.mobile.app SpardaApp com.mycelium.wallet Mycelium Bitcoin Wallet es.cm.android Bankia https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 27 of 28 Package Name App Name pl.mbank mBank PL com.wf.wellsfargomobile Wells Fargo Mobile exodusmovement.exodus Exodus: Crypto Bitcoin Wallet com.cmcmarkets.android.cfd CMC: CFD Trading com.google.android.play.games Google Play Games com.rbs.mobile.android.natwest NatWest Mobile Banking cz.csas.business24 BUSINESS 24 Mobilní banka com.bbt.myfi U by BB&T com.usaa.mobile.android.usaa USAA Mobile piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum com.breadwallet BRD Bitcoin Wallet. Buy BTC Bitcoin Cash, Ethereum com.engage.pbb.pbengage2my.release PB engage MY Source: https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html https://www.threatfabric.com/blogs/deceive-the-heavens-to-cross-the-sea.html Page 28 of 28