diff --git a/clusters/tool.json b/clusters/tool.json
index 6820a5ad..df6f2d0e 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -2898,6 +2898,18 @@
           "https://securelist.com/cowersnail-from-the-creators-of-sambacry/79087/"
         ]
       }
+    },
+    {
+      "description": "n mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility services.",
+      "value": "Svpeng",
+      "meta": {
+        "refs": [
+          "https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/"
+        ],
+        "synonyms": [
+          "trojan-banker.androidos.svpeng.ae"
+        ]
+      }
     }
   ]
 }