Herodotus: The Android Trojan That Types Like Humans

Cybercriminals are constantly developing techniques to make malicious software more difficult to identify.

One particularly concerning example is Herodotus, an Android banking Trojan that attempts to imitate human behavior while attackers remotely control infected devices.

Unlike automated malware that performs actions at obviously mechanical speeds, Herodotus introduces randomized delays between text inputs. This can make malicious activity resemble the actions of a legitimate smartphone user.

Security researchers at ThreatFabric publicly documented the malware in October 2025, highlighting its unusual approach to avoiding behavioral fraud detection.

Herodotus also uses familiar banking-malware techniques, including credential-stealing overlays, abuse of Android accessibility features, and remote device control.

Its discovery raises important questions about the future of mobile banking security.

How does Herodotus work? Why does human-like typing matter? And what can Android users and financial institutions do to reduce their exposure?

This guide explains the threat, its reported capabilities, and practical defensive measures.

What Is the Herodotus Android Trojan?

Herodotus is a type of Android banking malware designed to support financial fraud and unauthorized account access.

A Trojan is malicious software that disguises itself as something legitimate or useful.

In mobile banking attacks, malicious applications may impersonate security tools, banking utilities, or other trusted services.

Once installed and granted powerful permissions, these applications can attempt to collect sensitive information or allow attackers to interact with the device.

Herodotus belongs to a category commonly called device-takeover banking Trojans.

Its reported capabilities include:

• Remote interaction with an infected device

• Human-like text input delays

• Credential-stealing overlays

• Abuse of Android accessibility services

• Collection of information displayed on-screen

• Interception of SMS messages

• Attempts to conceal fraudulent activity

The defining characteristic is its effort to make attacker-controlled interactions appear more natural.

However, a human-like typing pattern does not make the malware undetectable. It is one technique designed to complicate certain fraud-detection methods.

Who Discovered Herodotus?

Cybersecurity company ThreatFabric documented Herodotus in research published in October 2025.

Researchers identified the malware's remote-control capabilities and examined code responsible for introducing irregular delays during text input.

They also reported active campaigns affecting users in Italy and Brazil.

The malware samples and supporting infrastructure suggested that its operators were developing a reusable platform for financial attacks.

Importantly, reports of malicious overlays associated with organizations in additional countries do not necessarily prove successful attacks in those locations.

The confirmed observations should be distinguished from potential future targeting.

Herodotus attracted attention because it combined familiar banking Trojan features with an unusual attempt to imitate ordinary human interaction.

How Does Herodotus Mimic Human Typing?

Many automated attacks involve entering information into applications through scripts or remote-control tools.

Such activity can produce timing patterns that differ from ordinary human behavior.

For example, an automated system might enter an entire string almost instantly.

Security systems can sometimes identify suspicious interaction patterns using behavioral signals.

Herodotus attempts to complicate this analysis.

Randomized delays between characters

ThreatFabric found that Herodotus could introduce randomized pauses between individual text inputs.

Researchers described delays ranging from approximately 0.3 to 3 seconds.

Instead of entering text in one immediate operation, the malware can spread input across a sequence of timed actions.

The goal is to make the activity appear more like ordinary typing.

Why typing patterns matter

Some fraud-detection systems examine behavioral characteristics such as:

• Typing rhythm

• Interaction speed

• Navigation patterns

• Touch behavior

• Session activity

• Device characteristics

These signals can help identify automated or suspicious behavior.

By changing the timing of text input, Herodotus attempts to reduce the effectiveness of defenses that rely too heavily on interaction speed.

However, researchers have not established that this technique bypasses every behavioral fraud-detection system.

Its effectiveness depends on the security controls being used.

How Does Herodotus Infect Android Devices?

Herodotus has been associated with deceptive application distribution and social-engineering techniques.

Attackers attempt to persuade users to install software that appears legitimate.

This may involve malicious links, impersonated services, or applications presented as security-related utilities.

1. Deceptive application distribution

A victim may encounter an application claiming to provide banking security or account verification.

The application may be distributed outside an official app store.

2. Social engineering

Attackers may use fraudulent messages to create urgency.

For example, a message might claim that an account requires immediate verification.

These approaches resemble common phishing campaigns that pressure recipients into taking unsafe actions.

3. Permission requests

After installation, the application may request access to powerful Android features.

Users who grant permissions without understanding their purpose may unintentionally enable malicious functionality.

4. Device compromise

With sufficient access, the malware can attempt to interact with applications and collect sensitive information.

The exact sequence depends on the malware variant, device configuration, permissions, and attack campaign.

Not every suspicious app or phishing message is connected to Herodotus, but these behaviors are common warning signs.

Why Android Accessibility Services Are Targeted

Android accessibility services are legitimate features designed to help people interact with their devices.

They support important accessibility needs, including alternative navigation and interaction methods.

Unfortunately, malicious applications can abuse these capabilities.

How accessibility abuse creates risk

When an untrusted application receives extensive accessibility permissions, it may gain the ability to observe or interact with parts of the device interface.

Depending on its implementation and permissions, malware may attempt to:

• Read information displayed on-screen

• Interact with interface elements

• Perform clicks or gestures

• Observe text fields

• Navigate between applications

The MITRE ATT&CK framework documents abuse of accessibility features as a technique used by Android threats.

This does not mean accessibility services are inherently unsafe.

The risk arises when an untrusted application misuses powerful permissions.

Users should be particularly cautious when an unfamiliar app requests accessibility access without a clear, legitimate reason.

Herodotus and Remote Device Takeover

One of the most concerning aspects of Herodotus is its reported device-takeover capability.

Rather than relying entirely on credentials stolen in advance, attackers can attempt to interact with applications on an infected device.

This creates opportunities to exploit an already active mobile session.

What remote-control functionality can enable

ThreatFabric documented capabilities involving screen interactions such as clicks, swipes, text input, and navigation.

These functions can allow attackers to manipulate the device interface.

The malware also reportedly supports overlays that interfere with what victims see.

For example, a fraudulent screen may display a message suggesting that a banking application is processing a request.

Meanwhile, unauthorized activity may be occurring behind the displayed message.

These techniques can make suspicious behavior harder for victims to notice immediately.

Remote-control functionality also illustrates why security teams must evaluate more than login credentials alone.

How Herodotus Attempts to Steal Banking Information

Banking Trojans commonly target financial credentials and authentication-related information.

Herodotus combines several reported capabilities that may support these objectives.

Credential-stealing overlays

An overlay is a screen displayed over another application.

Malware can use deceptive overlays to imitate legitimate banking interfaces.

If a user enters sensitive details into the fraudulent interface, attackers may capture that information.

SMS interception

Some banking services use SMS messages for authentication or notifications.

ThreatFabric reported SMS-stealing capabilities in Herodotus.

This creates additional risk when sensitive authentication information is accessible through compromised messaging functions.

Screen information collection

Abused accessibility capabilities may expose information displayed within applications.

These features can support surveillance of user activity and unauthorized account interactions.

It is important to recognize that the presence of these capabilities does not mean every infected device experiences the same outcome.

The consequences depend on the specific attack and available access.

Where Has Herodotus Been Detected?

ThreatFabric reported observing active Herodotus campaigns targeting users in Italy and Brazil.

In Italy, researchers identified malware presented using a banking-security theme.

In Brazil, another observed campaign involved an application represented as a security module.

Researchers also recovered materials that appeared relevant to financial organizations in other regions.

These observations suggest potential interest in broader international targeting.

However, they should not be interpreted as proof that every country represented in those materials experienced an active campaign.

Could Herodotus affect users in other countries?

Potentially, yes.

Mobile banking malware can be adapted for different financial services, languages, and regions.

Nevertheless, the presence of technical capabilities or targeting materials does not establish the current geographic scale of infections.

Users should rely on verified security advisories rather than alarming claims about unconfirmed outbreaks.

Is Herodotus Connected to Other Android Malware?

ThreatFabric identified code similarities between Herodotus and Brokewell, another Android banking malware family.

The research described overlapping technical elements and the use of a module associated with Brokewell.

However, those findings do not conclusively establish that both malware families have the same operators or developers.

Shared components can arise through code reuse, access to existing tools, or other development relationships.

The broader malware ecosystem

Android banking Trojans are part of a larger threat landscape involving credential theft, remote access, and financial fraud.

Some malicious tools are distributed through criminal service models, while others are developed for particular campaigns.

Similar concerns arise with remote-access tools that may have legitimate administrative uses but can also be misused.

The important lesson is that defenders must examine actual capabilities and behavior instead of relying only on malware names.

Malware-as-a-Service and the Growing Threat

Researchers reported that Herodotus was being promoted through a Malware-as-a-Service model.

Malware-as-a-Service, or MaaS, refers to criminal arrangements in which malicious software or related capabilities are offered to other actors.

This model may allow different operators to use similar tools against separate targets.

Why the model matters

It can:

• Support multiple campaigns using related malware

• Make malicious tooling available to additional actors

• Complicate attribution

• Encourage ongoing modifications

• Increase the importance of shared threat intelligence

However, discovering advertisements for malware does not reveal the exact number of active customers, infections, or successful attacks.

Security reporting should distinguish observed activity from assumptions about wider deployment.

How Herodotus Challenges Fraud Detection

Traditional fraud detection often combines account activity, device information, authentication events, and user behavior.

Behavioral biometrics can contribute valuable signals by identifying unusual interaction patterns.

Herodotus demonstrates why no single signal should be treated as conclusive.

Why interaction timing alone is insufficient

If security software assumes that machine-controlled activity always happens at unnatural speeds, attackers may attempt to introduce delays.

This can make one suspicious characteristic less obvious.

However, other indicators may remain detectable.

Examples include:

• Unusual application permissions

• Signs of remote device control

• Unexpected account activity

• Suspicious device conditions

• Changes in transaction behavior

Financial institutions should consider layered controls that evaluate multiple independent risks.

The lesson is not that behavioral biometrics are ineffective, but that they should form part of a broader security strategy.

How Android Users Can Protect Themselves

Although Herodotus uses advanced techniques, everyday security precautions remain important.

1. Install applications from trusted sources

Prefer official app stores and verified developers.

Avoid downloading banking or security applications from unexpected messages or unfamiliar websites.

2. Keep Google Play Protect enabled

Google Play Protect checks applications for potentially harmful behavior and can warn users about detected threats.

It is an important protective measure, although no scanning system guarantees detection of every malicious application.

3. Review application permissions

Be cautious when unfamiliar apps request accessibility access, SMS permissions, or other sensitive capabilities.

Investigate whether the requested access is necessary for the app's stated purpose.

4. Keep Android updated

Install available operating system and security updates.

Updates can address vulnerabilities and improve device protection.

5. Recognize phishing attempts

Avoid opening unexpected links that demand urgent account verification.

Instead, contact the relevant organization through its official app, website, or verified customer support channel.

6. Monitor financial accounts

Review account activity and enable available transaction alerts.

Report unfamiliar transactions promptly.

These steps reduce exposure to common mobile threats but cannot eliminate every possible risk.

What Should You Do if You Suspect Infection?

If you believe your Android device may be compromised, act carefully.

Step 1: Stop sensitive activity

Avoid entering banking credentials or approving financial transactions on the suspicious device.

Step 2: Contact your bank

Use a separate trusted device or verified contact method.

Explain the concern and ask whether account protection measures are needed.

Step 3: Secure important accounts

Change affected passwords from a trusted device.

Review account sessions and authentication settings.

Step 4: Investigate suspicious applications

Check for unfamiliar apps and unusual permissions.

Follow trusted Android and security-provider guidance for investigating and removing harmful software.

Step 5: Seek professional assistance

For suspected financial compromise or persistent malware, obtain qualified technical help.

In some situations, a verified backup and device reset may be necessary, but users should first understand the potential loss of local data.

Avoid relying on unverified “malware removal” applications advertised through unsolicited messages.

What Financial Institutions Can Learn From Herodotus

Herodotus highlights the importance of security approaches that account for evolving attacker behavior.

Banks and payment providers should evaluate whether their defenses rely too heavily on simple indicators of automation.

Strengthen layered fraud detection

Combine behavioral information with device-risk indicators, transaction context, and other appropriate signals.

Monitor changing attack techniques

Threat intelligence can help identify emerging methods involving Android accessibility abuse and remote control.

Educate customers

Provide clear guidance about official applications, suspicious permission requests, and fraudulent security messages.

Improve response processes

Ensure customers can quickly report suspicious activity and obtain assistance.

Financial institutions should also review broader AI security risks and emerging forms of automation that may change the threat environment.

Reliable defenses require continuing evaluation rather than one-time implementation.

Why Herodotus Matters Beyond Banking

Although Herodotus primarily targets financial applications, its techniques illustrate broader mobile security concerns.

Smartphones store valuable personal and business information, including messages, account sessions, and authentication details.

A compromised device may therefore create risks beyond one banking application.

Organizations that rely on mobile services should consider security throughout the application lifecycle.

This includes secure development, responsible permission design, user education, and incident response planning.

For businesses investing in mobile app advertising, protecting user trust is particularly important.

An application's marketing success cannot compensate for serious weaknesses in its security or customer experience.

Similarly, privacy-first practices should be integrated into how businesses collect, process, and protect customer information.

Frequently Asked Questions

What is the Herodotus Android Trojan?

Herodotus is Android banking malware documented by ThreatFabric in 2025. It supports remote device interactions and attempts to imitate human typing behavior through randomized input delays.

Why does Herodotus type like a human?

The malware introduces irregular delays between text inputs, apparently to make automated activity resemble legitimate behavior and complicate certain fraud-detection methods.

Can Herodotus steal banking credentials?

ThreatFabric documented credential-stealing overlays and other capabilities associated with financial fraud. Actual outcomes depend on the permissions obtained and the specific attack.

Does Herodotus affect every Android phone?

No. Herodotus is not an inherent feature or universal vulnerability affecting every Android device. Infection requires exposure to malicious software and relevant attack conditions.

Can Google Play Protect detect Herodotus?

Google Play Protect can help identify potentially harmful applications, but no security tool guarantees detection of every malware sample or variant.

Is Herodotus related to Brokewell?

Researchers identified technical similarities and reused components associated with Brokewell. These findings do not conclusively establish identical developers or operators.

Conclusion

Herodotus represents a notable development in Android banking malware because it attempts to disguise automated device interactions as human behavior.

Its randomized typing delays demonstrate how attackers may adapt to security systems that examine interaction patterns.

Combined with remote-control capabilities, credential-stealing overlays, and accessibility abuse, the Trojan presents serious risks to affected users and financial institutions.

However, its capabilities should be described accurately. Attempting to evade fraud detection is not the same as demonstrating universal success against security defenses.

For Android users, trusted application sources, careful permission management, device updates, and financial-account monitoring remain essential.

For security teams, Herodotus reinforces the importance of layered detection, continuous threat intelligence, and effective incident response.

As mobile threats evolve, protecting digital accounts requires both reliable technology and informed user decisions.