How to protect yourself from Ghimob, a trojan that targets banking apps on Android devices

You protect yourself from Ghimob and similar banking trojans by installing apps only from Google Play, keeping Google Play Protect turned on and never giving an unknown app access to accessibility features. Ghimob was discovered in 2020, but its method is still in use today, so the advice below still applies.

What is Ghimob and how does it work?

In November 2020, Kaspersky researchers described Ghimob in an analysis published on Securelist, also reported by NDTV Gadgets. It’s a trojan from the same family as the Brazilian banking trojan Guildma, and it targets financial and banking apps on Android devices. When it was discovered, its victims were in Brazil, but the targeted apps also included those of banks in Paraguay, Peru, Portugal, Germany, Angola and Mozambique.

Once on an Android device, the malware lets attackers control the device remotely. That way, hackers can carry out operations and transactions in banking apps right from the victim’s phone.

The threat spread by email. The message was sent in the name of a fake creditor and contained a malicious link, and the downloaded trojan posed as a legitimate app: Google Defender, Google Docs, WhatsApp Updater and others. None of them were on Google Play.

If the link was opened, the infected APK file downloaded directly. After installation, the trojan asked for access to the phone’s accessibility features, then sent the attacker a message saying whether the phone was locked with a PIN or a pattern, along with a list of the installed apps.

According to Kaspersky, Ghimob targeted 153 mobile apps: 112 Brazilian banking apps, 13 cryptocurrency apps, 9 international payment systems and the apps of banks in other countries. The attacker recorded the phone’s unlock PIN or pattern and carried out every operation from the victim’s device to get past the banking apps’ security.

The attacker displayed a black screen so the user wouldn’t notice the strange activity, and launched the apps in the background. The malware didn’t appear in the app list and prevented the user from uninstalling it or restarting the phone.

Is Ghimob still a threat in 2026?

Ghimob itself was a 2020 threat, with victims mostly in Brazil. Its method, however, is still used by Android banking trojans: a fake app, installed from outside the official store, asks for access to accessibility features and takes control of the phone.

Android has defended itself since then. Since Android 13, phones block accessibility access by default for apps installed from APK files downloaded from the internet (“restricted settings”). If a message or a call asks you to unlock this setting for an app, it’s almost certainly a scam. Google Play Protect also checks apps installed from outside the store, so don’t turn it off.

How do you protect yourself from this kind of infection?

Since this is a phishing attack, the first step is for users to always check whether the emails and text messages they receive are legitimate and not to open links in suspicious messages. You’ll find more tips in the article on how not to fall for phishing attacks.

Another useful tip is not to use your main email address on dubious websites or on social media, because your inbox will be flooded with messages and it will be hard to tell the important emails from the rest.

A few rules for Android phones:

• Install only reputable apps, from Google Play. Permission to install unknown apps is granted separately to each app (browser, file manager); leave it turned off.
• When installing apps, pay attention to permissions. A flashlight app, for example, shouldn’t have permission to access your photo gallery or contacts, right?
• Give access to accessibility features only to apps that really need it, such as a password manager or a screen reader.
• Install system and security updates. A phone that no longer gets security updates should be replaced.
• Turn on notifications for every transaction in your bank’s app. If the phone behaves strangely (black screen, apps that can’t be uninstalled, restart blocked), disconnect it from the internet and call your bank immediately, on the number on your card.
• On work phones, use centralized management (MDM), with a work profile kept separate from personal apps.

RezolvIT is an IT outsourcing company experienced in securing and protecting its clients’ infrastructure. Whether it’s laptops, desktops, servers or mobile devices, the company adopts and proposes solutions to head off any security threats that may arise. You’ll find details about our IT security services on their page.