The malware, spread via fake TikTok and Chrome downloads, demonstrates an evolution by combining banking fraud with surveillance and remote control.

Rokarolla targets 217 banking and crypto apps with 137 commands, enabling PIN, SMS code, and crypto payment theft.

Zimperium's zLabs found Rokarolla, an Android banking trojan with 137 commands that steals PINs, intercepts SMS, hijacks crypto payments, and kills Play Protect.