---
title: New Android Banking Trojan Silences Phones While Stealing Crypto
description: Beware of 'BankBot-YNRK,' an Android Trojan impersonating Indonesia's digital ID app, stealing crypto and banking data in SE Asia.
canonical_url: https://codekeeper.co/ticker/bankbot-ynrk-android-trojan-targets-se-asia
---

# New Android Banking Trojan Silences Phones While Stealing Crypto

Beware of 'BankBot-YNRK,' an Android Trojan impersonating Indonesia's digital ID app, stealing crypto and banking data in SE Asia.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 4, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Security researchers discovered a sophisticated Android banking Trojan called "BankBot-YNRK" targeting users in Indonesia and Southeast Asia. The malware disguises itself as Indonesia's official digital ID app, tricking users into installing it from outside Google Play Store. Once installed, the Trojan mutes all device alerts—calls, notifications, messages—to avoid detection while stealing cryptocurrency wallet data, banking credentials, and personal information. It specifically targets devices running Android 13 and earlier, exploiting accessibility features to gain complete remote control. The malware takes real-time screenshots of banking and crypto wallet apps to map their interfaces, then automates fraudulent transactions. It targets Bitcoin, Ethereum, Litecoin, and Solana wallets, extracting seed phrases and private keys without user knowledge. **Source:** [Dark Reading](https://www.darkreading.com/vulnerabilities-threats/android-malware-mutes-alerts-drains-crypto-wallets)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fbankbot-ynrk-android-trojan-targets-se-asia%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Accenture Confirms Security Incident After Hacker Claims Source Code Theft Aug 12, 2026](https://codekeeper.co/ticker/accenture-data-breach-azure-keys-stolen)

[Windows Netlogon RCE Reported Under Active Exploitation — Patch Now Aug 12, 2026](https://codekeeper.co/ticker/critical-netlogon-vulnerability-patch-immediately)

[Hackers Are Actively Exploiting a Critical VeloCloud Orchestrator Vulnerability Aug 11, 2026](https://codekeeper.co/ticker/critical-velocloud-flaw-cve-2026-16812)

[Cyberattacks Brevo Supply Chain Attack Hit Up to 100,000 Websites Sep 21, 2026](https://codekeeper.co/ticker/brevo-supply-chain-attack-malicious-code)