Overview
- Cleafy reports the fake VPN/IPTV app delivers Klopatra, a banking trojan that abuses Android Accessibility Services to seize control and siphon funds.
- The malware can read on-screen content, automate taps, access banking and crypto apps, and operate in a black-screen VNC mode to mask activity.
- Distribution occurs via malicious websites and sideloaded installs rather than the Google Play Store.
- Researchers say Klopatra surfaced in March 2025 and has undergone about 40 code iterations, with indicators pointing to a Turkish origin.
- Security guidance includes deleting Modpro IP TV + VPN, checking and revoking Accessibility permissions, enabling Play Protect, and installing apps only from trusted sources.