![\"Android](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/10\/1761902491_139_960x0.jpg\")
<\/p>\n<\/p>\n
Beware this humanized password stealer.<\/p>\n
SOPA Images\/LightRocket via Getty Images<\/p>\n
Updated October 29 with a statement from Google concerning the latest threat to Android users and how they are being protected from the Herodotus malware.<\/p>\n
Well, it\u2019s been quite the week or so for Google users. What with the news that Gmail passwords<\/a> were confirmed as being included as part of a 183 million credentials infostealer log, two emergency security updates<\/a> for Chrome, and an announcement of a wait until October 2026 for HTTPS by default<\/a> for Chrome browser users as well. Now, harking back to credential-stealers once more, comes the confirmation of a new threat to Android users in the shape of the Herodotus malware that can bypass biometric detection by mimicking human behavior. Here\u2019s what you need to know. <\/p>\n ForbesUpdate Now As Microsoft Confirms New Windows Admin ProtectionBy Davey Winder<\/a>The Android User Threat Posed By Herodotus<\/p>\n Newly published research from mobile threat intelligence specialists ThreatFabric has confirmed that a nasty piece of Android malware called Herodotus can mimic human typing and other behaviors to steal passwords and financial credentials while bypassing biometric detection protections.<\/p>\n \u201cDuring routine monitoring of malicious distribution channels,\u201d the ThreatFabric report stated, \u201cthe Mobile Threat Intelligence service discovered unknown malicious samples.\u201d These turned out to be a new Android banking trojan by the name of Herodotus which, the analysts said<\/a>, introduces \u201cgroundbreaking techniques to evade detection systems,\u201d to the mobile threat landscape. <\/p>\n This is no idea threat or research that is confined to security research labs, either. Active attack campaigns have already been identified in Brazil and Italy, and there is no reason to suspect they will not spread further afield as the malware-as-a-service offering is currently being marketed on underground cybercriminal forums. <\/p>\n What flags Herodotus as being different to other banking trojans, the report warned, is the ability to mimic human behaviour during remote control sessions. \u201cThe trojan deploys fake credential-harvesting screens over legitimate banking applications,\u201d ThreatFabric said, \u201ccapturing login credentials and two-factor authentication codes through SMS interception.\u201d But the text input automation during an attack employs \u201ca novel technique where operator-specified text is split into individual characters, with each character set separately at randomized intervals.\u201d<\/p>\n This human-like typing, with random delays of set text events of between 300 to 3000 milliseconds between character input, can evade those biometric protection systems that measure such typing timing. \u201cAndroid malware containing delays in input is not in itself uncommon,\u201d Aditya Sood, vice-president of Security Engineering at Aryaka, told me, \u201cas they\u2019re typically implemented to allow targeted app UIs to respond to inputs.\u201d But Sood warned that the random nature of the delays, in both frequency and duration, is problematic. \u201cThis is a novel technique, and while it’s still under development, successful Brazilian and Italian phishing campaigns exemplify its dangerous potential.\u201d<\/p>\n