Skip to content

S1231 GodFather

GodFather is an Android banking malware that uses virtualization to mimic legitimate applications and abuses accessibility services and other permissions to evade detection and exfiltrate sensitive data. First identified in 2020, GodFather targets nearly 500 banking applications, cryptocurrency wallets, and exchanges worldwide; however, its virtualization-based attacks have primarily focused on several Turkish financial institutions. This capability enables threat actors to steal banking credentials and other sensitive account information. 21

Item Value
ID S1231
Associated Names
Type MALWARE
Version 1.0
Created 29 August 2025
Last Modified 24 October 2025
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
mobile T1453 Abuse Accessibility Features GodFather has abused the accessibility service to prevent the user from uninstalling GodFather, to exfiltrate Google Authenticator one-time passwords and to steal credentials.1
mobile T1437 Application Layer Protocol -
mobile T1437.001 Web Protocols GodFather has leveraged WebSockets for C2.2
mobile T1429 Audio Capture GodFather has requested for the RECORD_AUDIO permission to record audio with the microphone.1
mobile T1616 Call Control GodFather has requested for the CALL_PHONE permission to initiate phone calls.1
mobile T1624 Event Triggered Execution GodFather has executed when victims utilize their trusted banking apps, as the malware redirects the victim to using a malicious version of the banking app.2
mobile T1646 Exfiltration Over C2 Channel GodFather has exfiltrated sensitive information over C2.21
mobile T1617 Hooking GodFather has used the Xposed hooking framework to intercept HTTP requests and responses, capturing and exfiltrating sensitive information, such as credentials.2
mobile T1629 Impair Defenses GodFather has intercepted API returns from banking apps that detect malicious services, and modifies the methods to return back an empty list hiding the presence of the malware and other active services.2
mobile T1629.001 Prevent Application Removal GodFather has abused the accessibility service to prevent the user from uninstalling itself.1
mobile T1630 Indicator Removal on Host GodFather has requested for the WRITE_EXTERNAL_STORAGE permission to delete files in the device’s external storage.1
mobile T1544 Ingress Tool Transfer GodFather has downloaded Google Play Store, Google Play services and Google Services Framework APK to a virtual folder.2
mobile T1417 Input Capture GodFather has the captured information about the device’s screen to include detailed tap events.2
mobile T1417.001 Keylogging GodFather has intercepted and recorded sensitive information from the application to include user credentials. GodFather has also leveraged a deceptive overlay that tricks users into submitting their device lock credentials which are captured.2
mobile T1516 Input Injection GodFather has abused the Accessibility Service to mimic victims’ actions and to redirect victims to its StubActivity when the victims attempt to use the original, legitimate banking application.2
mobile T1655 Masquerading -
mobile T1655.001 Match Legitimate Name or Location GodFather has imitated Google Play Protect, a security application pre-installed on all Android devices, and its functionalities, such as scanning the device and requesting for the accessibility service.1
mobile T1575 Native API GodFather has hooked onto the getEnabledAccessibilityServiceList API to return an empty list of active services, which hides GodFather and other active services.2
mobile T1406 Obfuscated Files or Information GodFather has obfuscated its Android manifest file with irrelevant permissions and manifest strings.2
mobile T1660 Phishing GodFather has generated fake notifications to lure the victim to phishing pages.1
mobile T1636 Protected User Data -
mobile T1636.003 Contact List GodFather has accessed the device’s contact list.1
mobile T1636.004 SMS Messages GodFather has requested for the Read_SMS permission to access SMS messages.1
mobile T1603 Scheduled Task/Job GodFather has utilized a timer to initiate a WebSocket connection.2
mobile T1582 SMS Control GodFather has requested for the SEND_SMS permission to send SMS messages.1
mobile T1418 Software Discovery GodFather has gathered a list of installed applications.21
mobile T1426 System Information Discovery GodFather has the ability to gain remote control of the victim device and to gather data associated with the device, including battery level, sound settings, and device brightness.2 GodFather has also obtained the phone’s state, including network information, phone number, and serial number.1
mobile T1422 System Network Configuration Discovery GodFather has accessed the device’s current cellular network information, including the phone number and the serial number.1
mobile T1670 Virtualization Solution GodFather has used virtualization to create a separate virtual environment that mimicked legitimate banking and cryptocurrency applications.2

References

  1. Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  2. Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩