Cyble Malware Campaign Targets 180 Banking and Crypto Apps
Cybersecurity firm Cyble has reported a malware campaign targeting roughly 180 banking, financial and cryptocurrency applications, raising fresh concerns about mobile security across the digital finance sector.
The campaign centers on an Android banking trojan that Cyble’s researchers have tracked under the name “OverlayPhantom.” According to Cyble’s analysis, the malware uses overlay attacks to intercept credentials from targeted applications, spanning traditional banking, financial services and crypto platforms.
What Cyble Found in the 180-App Campaign
The report identifies 180 applications across three categories: banking, financial services and cryptocurrency. The trojan is designed to detect when a user opens one of these targeted apps, then displays a fake overlay screen to harvest login credentials and sensitive data.
Overlay-based attacks are not new to Android, but the breadth of this campaign is notable. By casting a wide net across both traditional finance and crypto, the malware operators appear to be maximizing their potential victim pool rather than focusing on a single sector.
The finding aligns with a broader trend in mobile threats. A Kaspersky report noted that trojan banker attacks on smartphones increased by 56% in 2025, suggesting that financially motivated mobile malware is accelerating across the industry.
Why Crypto App Users Face Particular Risk
Crypto wallets and exchange apps present a high-value target for credential-stealing malware. Unlike traditional bank transactions, cryptocurrency transfers are typically irreversible once confirmed on-chain, giving attackers a narrow but decisive window to drain funds.
The campaign’s inclusion of crypto apps alongside traditional banking targets reflects a shift in how threat actors view digital asset platforms. As mobile-first crypto usage has grown, so has attacker interest in the credentials that protect those accounts. Recent security incidents across the industry, including concerns about platform reliability on networks like Sui, underscore how security remains a persistent challenge in crypto infrastructure.
Users who rely on mobile apps for managing crypto holdings or interacting with exchanges should treat this report as a reminder that app-layer security matters as much as on-chain security. Even hardware wallet users can be exposed if they authenticate through compromised mobile interfaces.
What Users Should Watch Next
Cyble has not published a full list of the 180 affected app names in its public blog post. Until researchers or app providers confirm which specific platforms are targeted, users should exercise general caution with Android app permissions and sideloaded software.
Practical steps include verifying that apps are downloaded only from official stores, enabling two-factor authentication where available, and monitoring accounts for unauthorized activity. Users managing significant crypto holdings may want to consider isolating wallet access to dedicated devices, a practice that has gained traction as mobile threats have grown alongside developments like institutional crypto product launches and increased government attention to digital asset security.
Security researchers and app developers are expected to release further details as the campaign is analyzed. Cyble’s blog remains the primary source for technical indicators and updates on OverlayPhantom’s behavior.
