Securelist

New Android Trojan 'Frogblight' Targets Turkish Users via Court Case App

First seen 15 Dec 2025, 09:50 UTC • Securelist

•92% similarity •38.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Security researchers identified a new Android banking Trojan named 'Frogblight' that specifically targets users in Türkiye. The malware initially masquerades as an app for accessing court case files through official government webpages and has since adopted other disguises, including that of the Chrome browser. It is capable of stealing banking credentials and collecting SMS messages.

ThreatCluster AI

Attack Flow

17 entities, 19 inferred relationships (STIX 2.1).

Technique (5)

Malware
Phishing
Trojan
T1059.007 - JavaScript
T1566 - Phishing

Indicator (8)

1249124fr1241og5121.sa
trojan-spy.androidos.smsthief.de
45.138.16.208
08a3b1fb2d1abbdbdd60feb8411a12c7
105fa36e6f97977587a8298abc31282a
115fbdc312edd4696d6330a62c181f35
8483037dcbf14ad8197e7b23b04aea34
9dac23203c12abd60d03e3d26d372253

Malware (2)

Coper
Frogblight

Affected Platform (1)

Android

Tool (1)

Chrome

Relationships

Coper communicates with 1249124fr1241og5121.sa
Coper communicates with trojan-spy.androidos.smsthief.de
Coper communicates with 45.138.16.208
Coper communicates with 08a3b1fb2d1abbdbdd60feb8411a12c7
Coper communicates with 105fa36e6f97977587a8298abc31282a
Frogblight communicates with 1249124fr1241og5121.sa
Frogblight communicates with trojan-spy.androidos.smsthief.de
Frogblight communicates with 45.138.16.208
Frogblight communicates with 08a3b1fb2d1abbdbdd60feb8411a12c7
Frogblight communicates with 105fa36e6f97977587a8298abc31282a
Malware targets Android
Phishing targets Android
Trojan targets Android
T1059.007 - JavaScript targets Android
T1566 - Phishing targets Android
Coper related to 115fbdc312edd4696d6330a62c181f35
Coper related to 8483037dcbf14ad8197e7b23b04aea34
Coper related to 9dac23203c12abd60d03e3d26d372253
Coper related to Chrome

Community

Browse all →

Tracked Entities in This Story

Coper Frogblight Android Malware Phishing Trojan Chrome

New Android Trojan 'Frogblight' Targets Turkish Users via Court Case App

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story