Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 17:18:55 UTC
Home > List all groups > List all tools > List all groups using tool ZitMo
 Tool: ZitMo
Names
ZitMo
ZeuS-in-the-Mobile
Category Malware
Type Banking trojan, Backdoor, Info stealer, Credential stealer
Description
(Kaspersky) The first version of ZeuS-in-the-Mobile (ZitMo), malware which targets mTANs,
was discovered in the end of September 2010. In that case it was targeting Symbian
smartphones. Later on, ZitMo versions for Windows Mobile and Blackberry were found. It
comes as no surprise that cybercriminals have created new and sophisticated pieces of mobile
malware for Symbian and Windows Mobile; more surprising is that Blackberry devices were
also targeted; and even more surprising is that until July 2011 there was no evidence of ZitMo
for Android’s existence. And now please ‘welcome’ ZeuS-in-the-Mobile for Android.
The first fact that must be mentioned is that ZitMo for Android differs from Symbian,
Windows Mobile and Blackberry versions a lot. The functionality and logic of ZitMo for
Symbian, Windows Mobile and Blackberry is the same: C&C cell phone number, SMS
commands, and the ability to forward SMS messages from a particular number, as well as the
ability to change C&C.
The functionality and logic of ZitMo for Android is far more primitive. The APK file itself has
a 19k size. It passes itself off as a security tool from the ‘Trusteer’ company.
Information Malpedia Last change to this tool card: 24 April 2021
Download this tool card in JSON format
All groups using tool ZitMo
Changed Name Country Observed
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea
Page 1 of 2

Unknown groups
  _[ Interesting malware not linked to an actor yet ]_  
1 group listed (0 APT, 0 other, 1 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea
Page 2 of 2