TeaBot is a malicious Android banking trojan that steals credentials and enables unauthorized account access. It typically captures screen content, intercepts messages, and abuses accessibility services or overlays to harvest secrets, then uses those stolen credentials to control financial apps and move money without user consent.
How TeaBot Works
TeaBot is a mobile banking trojan that sits between the user and the financial app by capturing what appears on the screen, reading messages, and abusing powerful Android accessibility or overlay permissions. Its core trick is to turn a trusted device into a credential-harvesting and transaction-manipulation channel.
That matters because the malware is not only stealing a password, it is trying to take over the whole authenticated session. Once it can view prompts, intercept one-time codes, or simulate user actions, it can bypass protections that rely on the user seeing and approving the right thing at the right time.
Credential Theft and Session Abuse
TeaBot targets secrets that have immediate value in a financial environment, including usernames, passwords, one-time codes, and session data that can be used to enter a banking app as if the real customer were present. This is why banking trojans often combine keylogging, screen capture, and message interception rather than relying on a single theft method.
The important security shift is from simple credential theft to session abuse. If an attacker can capture the login flow and then continue inside the app, the compromise can look like legitimate activity until money moves or the victim notices the account state has changed.
Android Permissions and Abuse Primitives
TeaBot depends on device-level capabilities that ordinary apps should not need for this kind of activity. Accessibility abuse can let malware inspect interface content and automate taps, while overlay abuse can place convincing screens over a real app to steal inputs or redirect the user.
These primitives are dangerous because they blur the boundary between the genuine app and the attacker’s interface. On a well-managed device, a user should treat any app requesting accessibility or overlay privileges as a high-risk signal, especially when the app has no clear business need for those permissions.
Detection and Containment
Defending against TeaBot is partly about user education, but the more reliable controls are device hardening, mobile threat monitoring, and rapid review of suspicious login or transaction activity. Security teams should look for unusual accessibility service usage, strange overlay prompts, new device registrations, and banking sessions that begin from unfamiliar device or network patterns.
Where compromise is suspected, the response should assume that authentication material and active sessions may be exposed. That means revoking sessions, forcing reauthentication, and reviewing whether financial transactions, messaging channels, or recovery settings were altered after infection.
Risk and Threat Considerations
TeaBot is especially dangerous because it turns a single device compromise into account takeover and fraudulent payment risk. The malware does not need to defeat the banking app’s controls directly if it can observe the user, steal the right secrets, and act through the legitimate interface.
Failure mechanism: The trojan abuses trusted Android features to capture credentials, intercept verification messages, and manipulate app interactions, which lets an attacker continue a valid-looking banking session.
Impact: Victims can lose account control, expose payment data, and suffer unauthorized transfers even when they believe the app and login process were used normally.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1056 — Input Capture | TeaBot steals credentials by capturing user input and screen activity. |
| T1113 — Screen Capture | TeaBot captures screen content to steal secrets and observe banking flows. | |
| T1636 — Adversary-in-the-Middle | TeaBot can intercept interactive flows and verification steps to steal secrets in transit. | |
| Recommendation — Monitor for input-capture techniques and flag unusual screen, keyboard, or accessibility-driven credential theft. Detect suspicious screen-capture behavior on mobile endpoints and investigate apps that expose protected content. Hunt for intercepted authentication flows and validate whether transactions or prompts were altered in-session. | ||
| NIST CSF 2.0 | PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | TeaBot targets credentials and session material used for access to financial apps. |
| DE.CM-09 — Malicious code is detected, identified, and mitigated | TeaBot is mobile malware that requires detection and containment on devices. | |
| Recommendation — Revoke exposed credentials and sessions, then verify that authentication records and app access paths are still trustworthy. Tune mobile threat detection to identify banking trojans and isolate infected devices quickly. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | TeaBot steals and reuses authenticators, messages, and session-enabling secrets. |
| Recommendation — Rotate compromised authenticators and invalidate session material after suspected mobile trojan activity. | ||
| OWASP ASVS | V6 — Authentication | TeaBot undermines login assurance by stealing credentials and verification data. |
| V7 — Session Management | TeaBot seeks to take over live sessions after initial login. | |
| V16 — Security Logging and Error Handling | TeaBot detection depends on logs that reveal anomalous login and transaction behavior. | |
| Recommendation — Strengthen authentication flows against credential theft and session replay on mobile channels. Invalidate suspect sessions quickly and review whether mobile authentication state was abused. Log mobile-authentication anomalies and transaction irregularities so compromised activity can be reviewed. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | TeaBot is about unauthorized account access and privilege misuse. |
| Recommendation — Revoke unauthorized access paths and remove accounts or tokens exposed by mobile compromise. | ||
Practitioner Guidance
What to watch for: Treat unexpected requests for accessibility, overlay, or notification-reading privileges as a control decision, not a routine prompt. For financial apps, those permissions should be exceptional and justified, because they are common abuse paths for mobile banking trojans.
Governance implication: Security teams and app owners should align mobile fraud controls with identity protection, not just malware detection. The practical question is whether a device can still be trusted to represent the user after a trojan has had access to the screen, messages, and input stream.