OpenTrojan Intelligence Infrastructure
Search intelligence, CVEs, threats… Search
Ask AI Analyst API
English中文
Enter Portal

BlackRock Banking Trojan

malware OpenTrojan Threat Intelligence

Android banking trojan on top of XHelper code

Source Attribution

Origin
MITRE
Source
Researchers
Verified
2026-08-26T16:11:50.351Z
Confidence
high

Source: Researchers · Verified: 2026-08-26T16:11:50.351Z · Confidence: high

Security Timeline

  • discovered BlackRock Banking Trojan first observed
  • updated Encyclopedia entry reviewed (Phase 45C)

Quick Answer

BlackRock is an Android banking malware abusing accessibility for overlay attacks. (attributes recorded from Researchers).

Definition

BlackRock is an Android banking malware abusing accessibility for overlay attacks.

Overview

BlackRock is an Android banking malware abusing accessibility for overlay attacks.

Behavior

  • Android overlay fraud
  • lockdown-like

First Seen

2020-07

Target

Android banking trojan on top of XHelper code

Malware Intelligence

Family: BlackRock Banking Trojan

Techniques: T1411, T1421

Targets: Android banking trojan on top of XHelper code

Behavior:
  • Android overlay fraud
  • lockdown-like

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating BlackRock Banking Trojan. The workspace is a structured analysis surface — not a chat — organised as:

  1. Question — what do you need to know about BlackRock Banking Trojan?
  2. Evidence — assertions mapped to verifiable references.
  3. Timeline — events in chronological order.
  4. Related Entities — CVE, threat actor, campaign, malware links.
  5. Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
  6. Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace

Recommended Tools

Every tool runs passively or locally — inputs are never stored and no target is scanned.Start an investigation on this entity →