deVixor: A New Android Threat Unveiled

Recently, cybersecurity analysts at Cyble identified a novel form of Android banking malware known as deVixor. This malicious software, targeting Iranian users, is noteworthy for its integration of ransomware capabilities. Since its emergence in October 2025, deVixor has rapidly grown in sophistication, advancing from basic phishing techniques to complex banking fraud and device monitoring functionalities.

After examining over 700 samples, the researchers at Cyble discovered deVixor is spread via malicious APK files. These are cunningly disseminated through phishing sites masquerading as legitimate car dealerships. It’s a comprehensive malware campaign that relies on a Telegram-based network for commands and updates, allowing operators to manage the spread efficiently.

Features and Strategy of deVixor

• Multi-Functionality: Combines theft of financial data, device tracking, and ransomware actions.
• Phishing Tactics: Entices users via fake sites promoting discounted cars.
• Data Exfiltration: Steals sensitive information like OTPs and account balances.
• WebView Injection: Uses JavaScript to intercept banking credentials.
• Ransomware Ability: Locks devices, demanding cryptocurrency payments.

The deVixor malware uses Firebase for its operational commands and leverages Telegram for managing infected devices. Each device is tagged with a unique identifier, which enhances the threat actors’ ability to control and monitor their reach. The growing subscriber base of their Telegram channel suggests this is no one-off operation; rather, it’s a sustained criminal service targeting Persian-speaking audiences, primarily within the Iranian financial and cryptocurrency sectors.

Protective Measures and Conclusion

As deVixor represents an evolved threat in the realm of Android malware, it’s crucial that users take proactive measures to protect themselves:

• Download apps only from trusted sources like the Google Play Store.
• Exercise caution with app permissions, especially those requested by unfamiliar applications.
• Utilize multi-factor authentication for increased security, particularly with banking apps.
• If suspicious activity is detected, report it immediately to relevant authorities.

By following these precautionary steps, users can significantly bolster their defenses against malware like deVixor. Staying informed and cautious in online behaviors is key to maintaining cybersecurity.

Stay vigilant online with Qsentinel, your partner in proactive security. Start protecting your digital presence today.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.