The trojan has been infecting mobile devices of users based in Brazil, Peru, Portugal, Paraguay, Mozambique, Angola, and Germany, to target financial apps of exchanges, banks, and cryptocurrencies.