An ongoing Android malware campaign targeting users of Iranian financial institutions has expanded to include new abilities to target an even greater number of people and prevent detection on compromised devices. The campaign consists of fake Android applications imitating the legitimate version of apps used by financial institutions. While originally only forty (40) Android apps had been discovered by researchers, a new report from Zimperium now states that more than 200 apps are connected to the malware campaign. These applications trick the device user into allowing escalated privileges before the malware abuses Android’s accessibility services to harvest financial information, including bank account details, passwords, and credit card numbers. The latest findings suggest that these apps can also intercept SMS messages as well as prevent the uninstallation of the application so it may continue to harvest information. Additionally, greater use of public hosting services and command-and-control (C2) servers has allowed the threat actors to quickly adapt to changes in the environment to continue the attack, such as certain domains being taken down. Additionally, the threat actor has been observed launching phishing attacks against the financial institutions they are attempting to impersonate. These phishing campaigns utilize malicious webpages to impersonate the original website of the bank or crypto exchange. These combined campaigns against both the banks and their users have allowed the threat actors to capture information about the devices used by the victims and their financial account information all while exfiltrating the information to two (2) different Telegram channels. CTIX analysts will continue to monitor the evolution of this campaign.