DoubleTrouble is an Android banking trojan that stopped bothering with fake bank websites and started handing itself out through Discord instead. Once it is on a phone it records the screen, logs every keystroke, blocks your banking apps behind a fake maintenance notice and takes instructions from more than fifty remote commands. Nothing about it is exotic. What makes it work is that people install it themselves.
Quick answer: DoubleTrouble spreads as an APK posted in Discord channels, disguised with a Google Play icon. It abuses Android Accessibility Services to record your screen, capture keystrokes and overlay fake login windows on real banking apps. Only install Android apps from Google Play or your bank, and check Settings, Accessibility for any service you did not switch on yourself.
Security firm Zimperium documented the family and its move to Discord, collecting twenty five samples of the earlier variant and nine more from the active campaign, split between droppers and payloads. The shift matters more than the malware itself, and it is worth understanding why. Zimperium published the full technical breakdown if you want the indicators.
DoubleTrouble at a glance
Source: Zimperium zLabs analysis of the DoubleTrouble family.
What it actually does once it is installed
This is not a single trick. DoubleTrouble stacks several capabilities that only make sense together, and every one of them runs on top of Accessibility Services.
| Capability | How it works | What it costs you |
|---|---|---|
| Overlay attack | Draws a fake lock screen or banking login on top of the real app | Your PIN and banking password |
| Screen recording | MediaProjection and VirtualDisplay, frames sent out as base64 encoded JPEG images | Everything you look at, including one time codes |
| Keylogging | Watches text change and text selection accessibility events, buffering them in a file called heart_beat.xml | Every credential you type anywhere |
| App blocking | Covers banking and security apps with a System Maintenance Notice | Your ability to notice or intervene |
| Clipboard theft | Reads whatever you copy | Recovery phrases, passwords pasted from a manager |
| Remote control | Simulates taps, swipes and button presses | Transactions approved without you touching the phone |
The screen recording deserves particular attention. It defeats the usual advice about app based two factor codes, because the attacker simply watches the code appear on your display in real time.
Why moving to Discord changed the maths
The earlier wave built convincing clones of European bank websites. That is expensive. Domains get burned, hosting gets pulled, certificates get revoked and every takedown resets the work.
A Discord channel costs nothing, needs no domain, serves files over infrastructure that no corporate firewall blocks, and comes with a built in audience that already trades files casually. Delivery over a trusted platform also means the download itself never looks suspicious in network logs. The malware did not get smarter. The distribution got cheaper. The same logic drives desktop campaigns, which is why it pays to scan files for malware before you download them.
Note: This is not a Discord vulnerability and there is nothing to patch. Discord is being used as free file hosting with a social layer attached, in exactly the way attackers have used Telegram, Dropbox and Google Drive before it.
The install chain, step by step
Understanding the sequence is what lets you break it. Every stage needs your cooperation.
| Stage | What happens |
|---|---|
| 1. Lure | An APK is posted in a Discord channel, often framed as a cracked app, a mod or a security update |
| 2. Dropper | A small installer app that carries the real payload hidden in its raw resources |
| 3. Session install | The dropper uses a session based install to place the payload, which wears a Google Play icon to look legitimate |
| 4. The ask | The app requests Accessibility access, usually framed as needed for the app to function |
| 5. Full control | With Accessibility granted it grants itself the rest, connects to its server and waits for commands |
To slow down analysis the authors gave methods and classes nonsensical two word names and packed the code with JSONPacker. That frustrates researchers. It does nothing to stop you refusing step four.
Warning: Accessibility Services is the single most abused permission on Android. It exists so screen readers can describe and control the interface for people who need it, which means anything holding it can read every screen and press every button. A media player, a game mod or a battery saver has no legitimate reason to ask for it.
How to check your phone in five minutes
Work through these in order. The first two catch almost everything.
Check what has Accessibility access. Open Settings, then Accessibility, then Downloaded apps or Installed services depending on your version of Android. Anything you do not recognise, or any app whose purpose has nothing to do with assistance, should be switched off immediately.
Check what can draw over other apps. Go to Settings, Apps, Special app access, then Display over other apps. Overlay attacks need this permission.
Check what can install unknown apps. In the same Special app access menu, open Install unknown apps and set every browser and messaging client to not allowed.
Run Play Protect. Open the Play Store, tap your profile picture, then Play Protect, then Scan. Older Android builds get security fixes slowly, which is worth knowing if you are still waiting for Android 17.
If you have a computer and USB debugging available, this lists everything installed outside the store, which is where an unwanted APK will show up.
# list third party packages only adb shell pm list packages -3 # find out where a suspicious package came from adb shell pm dump com.example.suspicious | grep -i installerPackageName # see which apps hold accessibility access adb shell settings get secure enabled_accessibility_services
An installer package name of com.android.vending means Google Play. Anything else on an app you did not deliberately sideload deserves a hard look.
If you find something
Do not start by tapping uninstall. Malware that holds Accessibility can cancel that dialog faster than you can read it. Boot into safe mode first, which loads the system without third party apps running, then remove it.
Press and hold the power button, then press and hold the Power off option until the phone offers safe mode. Once you are in, go to Settings, Accessibility, revoke the service, then uninstall the app. If it holds device admin rights you will need Settings, Security, Device admin apps to deactivate it first. Reboot, then change your banking passwords from a different device, not from the phone, and call your bank to review recent activity.
Tip: A factory reset is the only guaranteed cure once something has held Accessibility access. Back up photos and documents, not app data, then reset and reinstall from the store. It is a bad afternoon that beats a drained account. On the desktop side the equivalent last resort is cleaning a PC from a USB drive.
Frequently asked questions
Can DoubleTrouble infect an iPhone?
No. It is an Android family that depends on Accessibility Services and sideloaded APK installation, neither of which exists on iOS in that form. iPhone users face different threats, mostly phishing pages and configuration profile abuse rather than installed trojans.
Is Discord unsafe now?
No more than any file sharing platform. The risk is downloading and installing an APK from a stranger, which would be equally dangerous over Telegram, email or a forum link. Treat any Android package file offered in a chat as hostile.
Will antivirus catch it?
Sometimes. Play Protect and mainstream mobile security apps detect known samples, but the authors repack and obfuscate frequently, so detection lags new builds. Refusing the Accessibility prompt is far more reliable than hoping a scanner recognises the file.
Does a screen lock or biometric protect me?
Not against this. The trojan records what happens after you unlock, and can draw its own fake unlock screen to harvest the PIN. Biometrics protect against someone picking up your phone, not against software already running on it.
How do I know if my bank app has been overlaid?
Look for login screens that appear a beat too late, that lack your usual saved details, or that ask for information the app never normally requests, such as a full card number or a recovery phrase. A genuine maintenance notice from a bank does not block the app entirely while other apps keep working. If in doubt, contact the bank through a number you already have, not one shown on the screen. It is also worth understanding how encrypted messaging now works between iPhone and Android, since SMS codes remain the weakest link.
The bottom line
DoubleTrouble is a reminder that the weak point in Android security is rarely the operating system. It is the moment a user is persuaded to install a file from a chat window and then hand it the one permission that undoes every other protection. Install from the store, say no to Accessibility requests, and this entire class of attack fails at the first step.
