Rokarolla: The Android Trojan That Turns Your…

Discovered by Zimperium zLabs, the Rokarolla trojan deploys 137 commands and fake overlays to isolate victims, steal banking credentials, and neutralize every standard defense.

Zimperium zLabs researchers documented Rokarolla on June 16, 2026, an Android trojan that does more than steal financial credentials — it converts the compromised device into an environment controlled exclusively by the attacker. The technical analysis reveals a multi-stage attack chain with 137 remote commands, 217 banking and cryptocurrency apps in its crosshairs, and active victim-isolation techniques that invalidate standard countermeasures — from SMS-based MFA to bank phone alerts. The malware marks a qualitative leap in the mobile threat landscape: total device control replaces simple data harvesting, rendering both traditional technical defenses and human verification ineffective.

Key Takeaways

Rokarolla targets 217 banking and cryptocurrency apps with dynamic HTML overlays downloaded from C2 servers, intercepting credentials in real time during legitimate app use.
The trojan packs 137 remote commands — exceeding the 107 commands of the previously documented HOOK trojan — for persistent control, call blocking, audio muting, and disabling of Google Play Protect.
A fraudulent overlay mimics the Android unlock interface to capture PINs, patterns, and passwords even when the device is locked, bypassing lock-screen protection.
The Pseudo-VNC technique enables continuous screenshots via Accessibility Services without the visible MediaProjection prompt, evading user detection.

Infection Chain: The Fake Google Play Protect That Opens the Door

The infection begins on malicious sites impersonating legitimate apps such as Chrome and TikTok, as documented by Zimperium zLabs. The initial dropper masquerades as Google Play Protect to trick the user into installing the secondary payload. Once active, the malware abuses Android Accessibility Services to obtain elevated permissions, access to SMS, notifications, and full device control.

Accessibility escalation is not an endpoint but a springboard for a series of parallel compromise techniques. Researchers Vishnu Pratapagiri and Fernando Ortega highlighted that malicious capabilities include "harvesting lock screen credentials, exfiltrating sensitive contact lists and SMS data, and utilizing keyloggers to continuously record user input." The malware also integrates a keylogger, a UI logger, and clipboard-logging functionality to replace cryptocurrency wallet addresses with attacker-controlled ones.

Communication with command-and-control servers occurs over HTTPS with fallback domains and dynamic C2-list update mechanisms. This architecture ensures resilience against takedowns and allows operators to rapidly modify targets and tactics.

Victim Isolation: When the Phone Stops Being Yours

The defining trait of Rokarolla is not individual technical sophistication but their orchestration toward a specific goal: active victim isolation. The malware blocks incoming calls, mutes audio and vibration, forces the screen to stay on for uninterrupted background operations, and disables Google Play Protect. As Jason Soroko, senior fellow at Sectigo, observed: "The Rokarolla Trojan shifts focus from credential theft to victim isolation...This strategy, which represents an evolution in threats, traps the user in an environment in which they still have their phone, but it's out of their control."

"This audio suppression effectively masks critical signals such as security notifications or verification calls from banking institutions, significantly reducing the likelihood that the user notices or interrupts the transaction process" — Zimperium zLabs researchers

Replacing the device's normal perceptual flow has a systemic effect. The user receives no bank alerts, cannot be reached by customer service, and feels no notification vibrations. Even if aware of a possible problem, they lack the sensory tools to verify it. Soroko linked this evolution to a broader shift in the threat landscape: "Attackers understand passwords fail against network security protocols...Criminals must commandeer the smartphone hardware to execute transactions. This methodology will expand as institutions improve defenses."

How It Invalidates the Defenses We Know

Rokarolla sequentially neutralizes the standard countermeasures recommended to users and implemented by financial institutions. SMS-based MFA is intercepted through message access granted by Accessibility permissions. Google Play Protect is disabled via a specific remote command, as documented by The Hacker News: "one of its commands turns Play Protect off." The lock screen is bypassed by an overlay that faithfully replicates its interface, capturing unlock credentials directly from the user. Bank verification calls are blocked before reaching the user.

For enterprises with BYOD policies, the compromised device becomes a risky endpoint for the corporate network. Randolph Barr, CISO at Cequence Security, highlighted an additional vector: "Employers and service providers add a third risk layer. Each validation request is a new integration point, creating an additional attack surface." The numerical context provided by Barr — roughly 4 million mobile social-engineering attacks in 2024 and roughly 33 million mobile malware/adware incidents blocked the same year — places Rokarolla in a trend of maturing mobile threats rather than a technical island.

Detection and Dossier Limits

Zimperium has not attributed Rokarolla to a specific threat actor. The scale of the active campaign, the number of confirmed victims, and the precise geography of infections have not been disclosed. A C2 domain with a .it.com extension was observed, but no evidence confirms specific targeting of Italy. The exact mechanism of dynamic C2 updates — whether push or pull, and at what frequency — remains unspecified in the report.

Indicators of compromise have been published on Zimperium's GitHub repository. The report includes MITRE ATT&CK tactics and techniques mapping. The Hacker News spelled out a relevant operational limit: "There is no patch to apply here. This is malware, not a product flaw," underscoring that mitigation relies on user behavior and institution-side controls rather than automatic security updates.

What to Do Now

Verify the source of every APK outside the Google Play Store: the documented entry vector is installation from malicious sites impersonating popular apps.
Review active Accessibility permissions on the device: Rokarolla requires these permissions for total control, and revoking them drastically reduces the attack surface.
Implement authentication methods that do not depend on SMS or notifications on the mobile device, since both channels are compromised in the documented threat model.
Monitor behavioral anomalies — suspicious overlays, screen staying on, absence of ringtone or vibration not configured by the user — rather than relying exclusively on antivirus signatures.

FAQ

Does Rokarolla exploit an Android zero-day vulnerability?: No. It is malware distributed via social engineering and voluntary installation, not a system vulnerability exploit. No associated CVE exists, nor is there a patch to apply.
Why are 137 commands significant compared to other trojans?: The number exceeds the 107 commands of the HOOK trojan, indicating greater control granularity and operational versatility. More commands mean more compromise scenarios automatable without re-contacting the C2 server.
Does call blocking also work with VoIP or messaging apps?: The dossier documents blocking of traditional incoming calls. It does not specify whether interception extends to VoIP calls or push notifications from dedicated banking apps.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references