Antidot, a banking Trojan for Android devices, masquerades as a Google Play update, using overlay attacks, keylogging, and WebSocket for real-time communication with its C2 server to harvest sensitive data, initiate USSD requests, control device features, and implement VNC for remote control, showcasing the growing sophistication and multifaceted nature of mobile malware, underscoring the need for enhanced security measures and user awareness against evolving threats. ```
https://www.darkreading.com/endpoint-security/android-banking-trojan-antidot-disguised-as-google-play-update