A new Android malware threat is making waves across Europe, and it’s doing so under the disguise of a popular free streaming app.

In a recent report from Cleafy, security researchers uncovered a remote access Trojan (RAT) named Klopatra, which uses a fake IPTV and VPN app called Mobdro Pro IP TV + VPN to infect Android devices.

The app poses as a free tool for live TV and anonymous browsing. Instead, it installs Klopatra—malware that gives attackers full control over the infected device. Once embedded, this powerful banking trojan can read passwords, control apps, and even perform financial transactions without the user’s knowledge.

This is more than a one-off scheme as Klopatra has already compromised over 3,000 devices throughout Italy and Spain and should be a warning to all Android users.

How the Infection Works

Most users trust app stores to filter out malware, but Mobdro Pro IP TV + VPN bypasses those protections entirely. Since it’s not listed on Google Play, it must be sideloaded from external sources.

The fake app then prompts the user to allow installation of unknown apps. Once the permissions are granted, Klopatra is installed silently in the background. With Accessibility Services enabled, the malware gains wide-reaching powers, including:

• Reading anything displayed on the screen
• Logging every tap and keystroke
• Launching apps and navigating menus
• Simulating user actions like clicking “Send” or “Confirm”
• Executing full banking transactions

At night, when users are asleep and phones are left charging, attackers strike. They turn off the screen brightness and launch bank apps invisibly. With stolen PINs and passwords, they drain accounts while the phone appears inactive.

Why Mobdro Pro Was the Perfect Cover

Using a fake IPTV app as a dropper is a calculated move. The name Mobdro has long been popular among cord-cutters looking for free TV channels. By pretending to offer streaming and VPN services, the app draws in users eager for entertainment.

But the app’s only purpose is to install Klopatra. Once users click “Continue Installation,” the app requests dangerous permissions and deploys the real malware.

TROYPOINT TIP: We always recommend using a high-level VPN (such as Surfshark) with 3rd party apps as it provides the CleanWeb feature which will block ads and malware.

What You Can Do to Stay Safe

This attack highlights the dangers of sideloading apps and trusting unknown sources. Here’s how to reduce the risk:

• Review permissions: Watch for apps that ask for Accessibility Services or the right to install unknown apps.
• Update security tools: Use reputable antivirus software and keep it up to date.
• Reset credentials: If you installed a suspicious app, delete it immediately and change your banking passwords.
• Use a Trusted VPN: This will ensure that your private/personal information cannot get into the wrong hands.

IMPORTANT NOTE: Even legitimate VPNs aren’t always safe. A recent report found privacy issues with popular options like Turbo VPN and VPN Proxy Master. Many free VPNs use weak protocols like Shadowsocks, offering little real protection.

The Bigger Picture

Klopatra is a wake-up call. It’s not just another scammy app—it’s a full-blown fraud machine built with professional-grade tools. Its hidden control systems, banking overlays, and active botnets are proof that mobile malware has evolved.

As mobile banking grows, so do the threats. And with sideloading becoming more common among users looking for Free IPTV or modded apps, Android has become a prime target.

This article was originally published by Cleafy.com.

We want to know what you think of the latest 3rd party app containing malware. Let us know in the comments below!

Be sure to stay up-to-date with the latest streaming news, reviews, tips, and more by following the TROYPOINT Advisor with updates weekly.