FvncBot Malware Targets Android Users, Stealing Financial Data

First seen 6 Dec 2025, 16:49 UTC • •60

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

FvncBot is a new Android banking malware first observed on November 25, 2025. It is designed to capture keystrokes, record screens, and inject fake login pages into banking applications, primarily affecting users of mBank in Poland. The malware spreads through a fake application disguised as a security tool.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 241d ago How this analysis works

Threat Graph

6 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Phishing
T1056 - Input Capture

Organization (1)

MBank

Malware (1)

FvncBot

Affected Platform (1)

Android

Relationships

FvncBot targets MBank
Malware targets Android
Phishing targets Android
T1056 - Input Capture targets Android

Following this threat?

Track FvncBot and MBank in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

FvncBot Malware Targets Android Users, Stealing Financial Data

Article Content

More articles in this cluster (3)

Threat Graph

Following this threat?

Extracted Entities (7)

Attack Types (2)

Companies (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)