Imagine a malicious actor that doesn’t need to be fast to deceive your systems: it types slowly, hesitates, pauses — exactly like a human user.
That’s the technical gamble of Herodotus, a recent evolution of Android banking trojans that builds on Brokewell’s code and techniques.
For cybersecurity teams, this changes everything: defenses that only detect robotic automation are now bypassed.
The campaigns identified primarily target financial services, fintechs, and cryptocurrency wallets. These sectors are at risk because their users rely heavily on mobile apps and multi-step authentication. Hijacking a session in such a context turns a simulated “human” behavior into a very real fraud.
This article explains how this threat works, its financial impact on banks, and—most importantly—the concrete operational and technical measures that can prevent it.
1. Attack Technique and the Brokewell Link
Herodotus is an Android banking trojan combining RAT (Remote Access Trojan) and spyware capabilities. It gains Accessibility permissions and uses overlay windows to display fake login screens and intercept 2FA codes (SMS). Its main innovation is its ability to simulate human typing by injecting random delays between each keystroke (≈300–3000 ms), tricking behavioral biometrics and fraud detection systems.
Herodotus reuses Brokewell’s components and techniques (string encryption, dynamic modules, coordinate-based actions), showing a clear technical lineage—partial source reuse or shared modules. Brokewell thus acts as both predecessor and component pool.
MITRE ATT&CK reference points: T1417 Input Capture (keystrokes, SMS) · T1516 Input Injection (touch/text events) · T1204.001 / T1566 Malicious Link / Phishing (SMiShing infection chain).
Banking Credentials
Exfiltrating login details from banking apps to enable unauthorized transactions
Intercept 2FA codes
Capturing two-factor authentification codes to bypass security
Stimulate User Interaction
Emulate keystrokes & touches with random delays
MITRE ATT&CK reference points: T1417 Input Capture (keystrokes, SMS) · T1516 Input Injection (touch/text events) · T1204.001 / T1566 Malicious Link / Phishing (SMiShing infection chain).
2. Financial Impact on Banks — From Code to Cash Flow
It always starts innocently: a customer installs a “security update,” grants Accessibility rights, and sees a familiar login page. The “human” typing convinces the fraud engine, and the transaction goes through. At scale, this micro-scenario repeats — and monetizes itself.
First come direct losses: unauthorized transfers, crypto purchases, account takeovers. Then the post-incident costs: disputes, reimbursements, customer reassurance. Meanwhile, IT teams invalidate sessions, reset passwords en masse, and comb through logs. Operational hours and costs skyrocket.
Reputation follows the same curve — digital customers lose confidence, especially those who transact the most. Then comes regulatory pressure: incident reports, corrective plans, and sometimes fines if MFA, anti-fraud, or MDM controls weren’t aligned with regulatory expectations.
Herodotus’s “innovation” is therefore not just an R&D challenge; it’s a total cost of threat ownership. Less visible than the value of a fraudulent transfer, but often heavier. Scaling defenses is no longer optional; it’s a profit-and-loss lever.
The good news? The fix doesn’t require rewriting your banking app. It requires refocusing detection on device posture and eliminating interceptable factors. In short, making the execution context harder to fake than a human gesture.
3. Protection — A Clear, Device-Centric and Journey-Aware Strategy
Defending against Herodotus begins with a simple idea: cut off its oxygen. Most infections come from Android installation files known as APKs (Android Package Kits)—apps downloaded outside the official Play Store. These can contain malicious code. Organizations should block their installation using centralized mobile management systems like EMM (Enterprise Mobility Management) or MDM (Mobile Device Management), which allow security teams to control devices and authorized apps remotely.
The second line of defense is limiting what already installed apps can do. Herodotus abuses the Accessibility service in Android, originally designed to assist users with disabilities. When an app gains this privilege, it can literally read what’s on the screen and perform actions on behalf of the user. If granted to a rogue app, it gives full control of the device. Security teams should therefore correlate every new Accessibility request with other events—such as a recent app installation or an unusual outbound connection.
This is where another technical term comes in: MQTT, a lightweight communication protocol often used in the Internet of Things. Modern malware use it to silently exchange commands with their C2 (Command and Control) servers. Monitoring such traffic helps identify compromised devices even when everything looks normal.
Finally, one of the most effective measures is to replace SMS verification codes with stronger methods. Phishing-resistant MFA such as FIDO2 keys or passkeys make these attacks much harder, because there’s simply nothing to intercept.
In short, a strong mobile security policy relies on three pillars: prevent unauthorized installations, monitor sensitive permissions like Accessibility, and remove easily exploitable authentication channels. Together, these actions give banks and fintechs back control over the endpoint — and over user trust.
Herodotus doesn’t win because it’s smarter; it wins because it behaves more like us. Regain the upper hand by shifting the fight from behavior to context: verified devices, controlled permissions, non-interceptable MFA, and correlated detection. Fraud drops, confidence returns.
Source:
