⚠️ Overview

GoldDigger is an Android banking trojan first discovered by Group-IB in June 2023, attributed to a Vietnamese-speaking threat actor tracked as the GoldFactory group. It falls under the category of financial malware and info-stealer, primarily designed to steal credentials, SMS messages, and one-time passwords (OTPs) from victims’ mobile devices.

🔧 Technical Capabilities

GoldDigger abuses Android Accessibility Services to perform overlay attacks on over 50 Vietnamese banking and cryptocurrency applications. It uses a remote access trojan (RAT) module that allows attackers to exfiltrate SMS messages, contact lists, and call logs, and to intercept OTPs in real time. The malware employs a custom C2 protocol over encrypted sockets (TCP/443 or TCP/8443) and can download additional payloads, including a VNC module for live screen sharing. Persistence is achieved through Android device admin abuse and by disabling Google Play Protect. Evasion techniques include obfuscated code, dynamic loading of DEX files, and checking if the device has developer options enabled to avoid analysis.

📜 History & Notable Incidents

GoldDigger was first detected targeting users in Vietnam in mid-2023, with campaigns later expanding to Indonesia and the Philippines. Group-IB reported that the malware was distributed via malicious APK files hosted on phishing websites mimicking legitimate bank portals and cryptocurrency exchanges. No major law enforcement actions or CVEs have been publicly associated with GoldDigger as of early 2025.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6… (specific hash redacted in public reports). Behavioral indicators include requests for Accessibility Service permissions, persistent SMS forwarding to hardcoded phone numbers, and outbound connections to IPs on TCP ports 443 or 8443 with non-standard TLS certificates. Registry keys are not applicable as it targets Android; however, package names often mimic legitimate apps like com.vnpay.quick or com.timo.bank.

☠️ Risk & Impact

GoldDigger directly threatens financial assets by stealing banking credentials and bypassing two-factor authentication through SMS interception. Affected sectors primarily include retail banking and cryptocurrency services in Southeast Asia. Group-IB estimates that the malware has compromised thousands of devices, leading to average financial losses of several thousand dollars per victim.

🛡️ Mitigation

Users should enable Google Play Protect, avoid sideloading APKs from untrusted sources, and revoke Accessibility Service permissions for any app that does not require them. Organizations can deploy Group-IB’s YARA rules (available in their 2023 report) and monitor network traffic for connections to suspicious IPs associated with the GoldFactory C2 infrastructure.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.