The software is currently attacking users in 16 different countries. Confirmed infections include 215 banking apps, 94 cryptocurrency wallets and 110 crypto exchange platforms. The most documented cases of trojan activity were discovered in the United States, Turkey, Spain, Canada, France, Germany and the UK.

The trojan displays fake versions of popular financial and cryptocurrency applications on infected mobile devices. Unaware users provide fraudsters with sensitive personal data and face a heightened risk of losing their funds. In addition, GodFather allows hackers to record the screen of the victim's device, launch keyloggers, send SMS from an infected smartphone or tablet and bypass two-factor authentication.