Twitter user “MalwareHunterTeam” spotted a variant of the popular 2-year-old trojan malware “Hydra” targeting Commerzbank, Germany’s second largest bank. This variant includes many new features for data gathering and phishing. The Android application is named “Commerzbank Security” and uses the same icon as the official Commerzbank app. The app requests twenty-one (21) permissions, including requesting admin privileges and enables running in the background. Cyble, in their published report linked below, identified multiple classes in the malware that collect personal information, send bulk SMS messages, call threat actor’s phone, steal credentials, record the screen, and disabling built-in security features. It also connects to the command-and-control (C2) server using a TOR connection. Commerzbank serves 13 million German customers which are all potential victims of this malware.