FvncBot Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
6
occurrences
First Seen
December 6, 2025
Last Seen
February 6, 2026

FvncBot is a malware family tracked across 3 threat clusters and 6 intelligence report mentions on ThreatCluster. First observed December 6, 2025; most recent activity February 6, 2026.

Overview

FvncBot is an Android banking malware family that captures keystrokes and injects malicious payloads to steal credentials and enable fraudulent transactions. It drops additional payloads to expand access, making it a notable mobile threat amid the December 2025 surge in Android banking malware.

Related Threat Clusters

  • FvncBot Malware Targets Android Users, Stealing Financial Data

    FvncBot is a new Android banking malware first observed on November 25, 2025. It is designed to capture keystrokes, record screens, and inject fake login pages into banking applications, primarily affecting users of…

    3 articles · Updated December 6, 2025
  • FvncBot Malware Targets Android Banking Users in Poland

    A new malicious application named FvncBot has been identified, targeting mobile banking customers in Poland. Disguised as a legitimate security tool from mBank, it exploits Android's accessibility services to deploy a…

    2 articles · Updated February 6, 2026
  • Surge in Android Malware: Albiriox and Sturnus Target User Accounts

    In 2025, Android users are facing a significant increase in malware threats, specifically from strains named Albiriox and Sturnus. These malware types are capable of taking over personal accounts, manipulating banking…

    2 articles · Updated December 30, 2025

Recent Intelligence Reports

  • New FvncBot Attacking Android Users by Exploiting Accessibility Services — Cybersecuritynews · February 6, 2026
  • FvncBot Targets Android Users, Exploiting Accessibility Services for Attacks — Gbhackers · February 6, 2026
  • 2025 Android Malware Surge: Albiriox and Sturnus Enable Account Takeovers — Webpronews · December 30, 2025
  • New FvncBot Android Banking Attacking Users to Log Keystrokes and Inject Malicious Payloads — Cybersecuritynews · December 6, 2025
  • Android Users Hit by FvncBot Malware Capturing Keystrokes and Dropping Payloads — Cyberpress · December 6, 2025
  • FvncBot Android Malware Steals Keystrokes and Injects Harmful Payloads — Gbhackers · December 6, 2025

CVSS v3.1 Breakdown