New research from Intel 471, CYFIRMA, and Zimperium reveals the emergence of three advanced Android malware families—FvncBot, SeedSnatcher, and an upgraded variant of ClayRat—designed to steal financial data, cryptocurrency assets, and full device control. These threats demonstrate a rapidly evolving mobile malware ecosystem, increasingly built around exploiting Android Accessibility Services and sophisticated overlay attacks.

Android remains the largest mobile operating system globally, making it a prime target for financially motivated and state-linked threat actors. Banking trojans, wallet stealers, and spyware families continue to converge in capability, often incorporating remote access, credential harvesting, and screen streaming. The newly identified malware families expand this trend with custom-built codebases, advanced evasion, and powerful automation.

Researchers identified:

Collectively, these malware families represent a significant escalation in Android-focused cybercrime, with actors adopting more modular, stealthy, and automated infection workflows.

These malware families enable:

The combination of HVNC, overlays, FCM-based command delivery, and accessibility abuse gives attackers near-total visibility and control of infected devices.

Android malware is rapidly maturing beyond simple credential theft.
The convergence of:

…represents a fundamental shift in attacker capability. Mobile devices are no longer just endpoints—they are becoming full attack surfaces for financial, espionage, and identity theft campaigns.

Researchers emphasize that Accessibility Services—designed to help disabled users—are becoming the most abused Android feature for full compromise.
Malware families are increasingly:

As Zimperium notes, ClayRat's newest features mean victims may no longer be able to interrupt or remove infections without deeper system intervention.