Sturnus Android Trojan Exposes Secure Messaging Apps in Major 2024 Threat

In May 2024, security researchers uncovered a new Android banking trojan named Sturnus targeting mobile devices in the wild. Sturnus stands out for its advanced multi-stage capabilities, allowing the malware to intercept and exfiltrate end-to-end encrypted messages from applications such as Signal, WhatsApp, and Telegram. The malware also leverages device accessibility services to gain total device control, enabling it to steal SMS, contacts, banking credentials, and intercept two-factor authentication (2FA). Initial infection is typically achieved via malicious sideloaded APKs distributed through phishing campaigns and third-party app stores, exposing users to substantial data theft and account compromise risk.

This incident highlights a growing trend in Android malware evolution, where banking trojans are increasingly equipped with multi-app message theft, advanced evasion techniques, and device takeover functions. The widespread use of encrypted messaging apps in business and personal communication elevates the threat, driving demand for enhanced mobile endpoint security and stricter controls on app distribution.

Sturnus exemplifies the urgent need for robust Android device security amid escalating threats targeting encrypted communications and banking data. Its sophisticated techniques reflect a macro-shift toward multi-functional malware, increasing organizational risk of sensitive data exposure, compliance violations, and financial losses—necessitating immediate attention to endpoint controls, employee awareness, and mobile application vetting.