Cybersecurity researchers are tracking a new variant of an Android malware dubbed “FakeCall”. The malware is designed to intercept phone calls made to the victim’s bank and route the call to an attacker-owned phone number. Built for Android and deployed via an APK (Android Package Kit), the malware reroutes calls by setting itself up as the default call handler during installation. FakeCall displays a convincing UI that mimics Android’s call interface, displaying the bank’s legitimate phone number while the victim is actually on a call with the attacker. FakeCall is delivered via social engineering attacks, and the attacker’s goal is to obtain sensitive banking information from the victim. The FakeCall trojan was first seen in 2022 and is now impersonating over twenty (20) financial organizations. In addition to hijacking calls, the latest versions of FakeCall include a new phone listener service which allows the attacker to issue commands to the device to get the device’s location, delete applications, record audio or video, and edit contacts. New commands also allow the attacker to live stream the device’s screen content, take screenshots, unlock the device, and delete and upload images. CTIX analysts recommend that individuals refrain from installing applications via APKs and opt for the more secure Google Play store. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.