Researchers have found a phony Flash Player download for Android that installs banking malware and steals banking credentials.

The black market for malicious Android software is heating up thanks to a rise in popularity of overlay malware, which can siphon credentials off Android devices and give crooks a tool to defeat two-factor identification schemes, according to security researchers at IBM’s X-Force. Overlay malware allows attackers to create an overlay to be displayed on top...