MITRE ATT&CKsoftware (malware)
S1231 GodFather
- Domain
- mobile
- Platforms
- Android
- Version
- 1.0
- Created
- 2025-08-29
Description
GodFather is an Android banking malware that uses virtualization to mimic legitimate applications and abuses accessibility services and other permissions to evade detection and exfiltrate sensitive data. First identified in 2020, GodFather targets nearly 500 banking applications, cryptocurrency wallets, and exchanges worldwide; however, its virtualization-based attacks have primarily focused on several Turkish financial institutions. This capability enables threat actors to steal banking credentials and other sensitive account information.
Related
Uses · MITRE ATT&CK (26)
- T1670 Virtualization Solution technique
- T1660 Phishing technique
- T1655.001 Match Legitimate Name or Location sub-technique
- T1417.001 Keylogging sub-technique
- T1437.001 Web Protocols sub-technique
- T1629 Impair Defenses technique
- T1629.001 Prevent Application Removal sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1646 Exfiltration Over C2 Channel technique
- T1624 Event Triggered Execution technique
- T1630 Indicator Removal on Host technique
- T1617 Hooking technique
- T1616 Call Control technique
- T1603 Scheduled Task/Job technique
- T1582 SMS Control technique
- T1575 Native API technique
- T1544 Ingress Tool Transfer technique
- T1516 Input Injection technique
- T1406 Obfuscated Files or Information technique
- T1417 Input Capture technique
- T1418 Software Discovery technique
- T1422 System Network Configuration Discovery technique
- T1426 System Information Discovery technique
- T1429 Audio Capture technique
- T1453 Abuse Accessibility Features technique
References
- https://www.merklescience.com/blog/the-godfather-android-malware-threat-under-the-lens MerkleScience_Godfather_April2023
- https://zimperium.com/blog/your-mobile-app-their-playground-the-dark-side-of-the-virtualization ZimperiumOrtegaPratapagiri_GodFather_Jun2025