diff --git a/clusters/tool.json b/clusters/tool.json
index 2eecbbf..97b7e4e 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -2889,6 +2889,18 @@
           "https://researchcenter.paloaltonetworks.com/2017/07/unit42-spydealer-android-trojan-spying-40-apps/"
         ]
       }
+    },
+    {
+      "description": "n mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility services.",
+      "value": "Svpeng",
+      "meta": {
+        "refs": [
+          "https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/"
+        ],
+        "synonyms": [
+          "trojan-banker.androidos.svpeng.ae"
+        ]
+      }
     }
   ]
 }