Takealot and DStv Fake Sites Push Android Banking Malware

In Short

• Takealot impersonation pages are being used to trick people into installing Android malware.
• The malware includes remote access trojans and banking trojans, which can take over a phone and banking apps.
• Attackers often steal one-time PIN codes from SMS, weakening two-factor authentication.

What Happened

A wave of fake websites is impersonating trusted brands, including Takealot and DStv, to push Android banking malware in South Africa and elsewhere in Africa.

NordVPN said the attacks usually start with social engineering, meaning criminals use believable messages to get victims to do something risky. Victims receive SMS, WhatsApp, or social media messages with urgent hooks like job offers, tax refunds, ID renewals, or pension checks. The link then opens a website that looks like a real company page and asks the victim to install an Android app.

NordVPN says the installed app can be a Remote Access Trojan, which is malware that gives an attacker remote control of your phone, or a banking trojan designed to target banking apps. It can run quietly in the background and keep working after a restart. The permissions requested are a key warning sign, like access to SMS, contacts, call logs, screen capture, microphone, and camera.

A core risk is SMS interception. If the malware can read incoming SMS messages, it can capture OTP codes, which banks use as a second step when logging in or approving transactions. NordVPN said this can neutralise two-factor authentication, letting attackers approve transactions themselves.

The firm said it has linked more than 100 domains to the operation, active since at least August 2025. Many of the domains use disposable extensions like .xyz and sit behind Cloudflare.

Why It Matters

Android has a large installed base in South Africa, StatCounter estimates it at over 76% of the mobile operating system market. That makes Android users a high-value target for banking app takeovers.

For fintechs, banks, and merchants, these campaigns raise customer support costs and fraud losses, and they also erode trust in digital onboarding and app-based payments.

For users, the practical advice is simple. Do not install apps from links in messages. Install only from official app stores, and treat urgency as a red flag. If you suspect an infection, disconnect from the internet, uninstall the suspicious app, change passwords from a different device, and contact your bank.