This new malware can steal your money – and secretly read your WhatsApp messages

There’s a new cyber threat spreading quietly across Europe – and experts say it could be one of the most invasive attacks Android users have seen in years. Sturnus, as it is called, is the name of this cyber threat. It’s not just after your bank account details. It also wants access to private conversations.

Security researchers have been tracking the malware as it slips into phones through phishing traps – those links that look harmless at first glance but unlock chaos once tapped. Many victims are unaware that anything is wrong. Not until they spot strange bank movements… or messages they never wrote.

A Trojan that knows your bank – and your screen

The first red banner was flown by ThreatFabricSturnus is being analysed by a team of cybersecurity experts. They believe it’s still in its early stages – which is worrying, considering it’s already so capable.

Sturnus lies in wait once it finds its way to a device.
It then does two alarming things.

This malware steals your banking credentials
Fake login screens are displayed that look identical to the real thing. Users enter their login details thinking they are accessing their bank normally. Criminals collect the keys – and take control.

Hackers can take full control of the device.
They can do anything you can.
Every tap, every swipe… Sturnus sees it.

The part that worries the experts is the last one.

Sturnus can read private chats even if the encryption is end-to-end.

Because of the end-to-end security, millions of people trust WhatsApp, Telegram, and Signal. Conversations that no one else can see – not even the app creators.

But encryption protects only messages in transit. Once they appear on your screen, they’re decrypted – and visible.

Sturnus makes the most of this exact moment.

The malware spreads by abusing Accessibility Services (a tool that helps users with disabilities navigate their phones).

• The monitor displays whatever appears on the screen
•  Messages captured the moment they are seen
•  Records sensitive data without triggering suspicion

It does not need to crack encryption. It is waiting for you unlock the message.

Verification codes
Chats with bankers
Shared files
Secrets of the heart

There is no such thing as a private life anymore.

The threat is just getting started

Researchers claim that the malware was developed and distributed not by an amateur, but by a private company. Its primary targets to date appear to include:

• European banking app users
• Android devices
• Phishing messages expose victims

Cybercriminals seem to be preparing for a bigger wave of attacks – and Sturnus is already sophisticated enough to:

•  Move money undercover
•  Track what you type
•  You can spy on your own messaging habits
•  Hide malicious activity in normal usage

No one wants a version two if this is the first version.

How to protect yourself – before it’s too late

Experts advise Android users strongly to:

• Download apps and files only from known sources.
• Reject any suspicious permissions. This includes Accessibility Services
• Check your account frequently
• Update your mobile phone and its apps regularly
• Consider using reputable mobile security devices

If you suspect that you have been attacked, what should you do? Immediately disconnect from WiFi and mobile data – and call your bank.

Sturnus proves that cybercrime isn’t just evolving – it’s becoming personal.
Your identity. Your money. Your private messages. You may not even know that you are in the crosshairs for a silent attack.

Stay alert. Your phone is watching – someone else might be too.