MTC: Judges Will Be Hunting These AI Tricks After Brazil’s Scandal

it is hard to believe that judges will be happy if lawyer insert “code” into their online filings!

Recently, Brazilian court officials uncovered something that should make every tech‑savvy lawyer sit up straight. In a labor court, staff discovered a filing that looked ordinary to the human eye—until they examined it more closely. Hidden in the document was text written in white font on a white background, invisible to anyone casually reading the PDF but fully legible to the court’s AI system.

That invisible text was not a typo. It was an instruction—what technologists call a “prompt injection”—telling the court’s AI software to review the case only superficially and not to challenge the evidence submitted. In other words, the filing was designed to trick the judiciary’s own AI tools into rubber‑stamping a favorable outcome by smuggling in commands that humans would never see.

Fortunately, court staff caught the scheme before it affected the proceedings. But Brazilian authorities immediately recognized the incident as a new species of digital fraud and began discussing safeguards: automatic detection of invisible text, formatting checks before AI processing, and stronger human oversight at every stage. They also raised the prospect of stricter ethics rules and sanctions for lawyers who try to manipulate court AI systems.

For our purposes, the Brazil case does three important things:

1. It confirms that AI now sits inside judicial workflows—not just law firm workflows.

2. It shows that some lawyers will try to game those systems if they think they can get away with it.

3. It gives us a concrete example of what not to do and what to watch for as courts in the U.S. and elsewhere adopt similar tools.

From an ABA perspective, a “white‑text prompt injection” is not clever lawyering—it’s a direct collision with Model Rule 3.3 (candor toward the tribunal) and Model Rule 8.4(c)’s prohibition on conduct involving dishonesty, fraud, deceit, or misrepresentation. And because the Brazil incident exploits the very AI tools that the judiciary is using, it also implicates Model Rule 1.1 and Comment 8: the duty of technology competence now includes understanding how these systems can be abused.

So let’s unpack what we should learn from Brazil—starting with what not to do.

What Not To Do: Hidden Instructions and “Clever” Hacks

The Brazil case is a textbook on the wrong way to think about AI in litigation.

• Do not embed hidden commands in filings (through white‑on‑white text, metadata, or other tricks) with the intent to influence how a court’s AI tools process your case.

• Do not treat court‑side AI as just another system to be “SEO‑optimized” or hacked. Unlike a marketing algorithm, this is part of the machinery of justice; trying to tilt it in your favor crosses a bright ethical line.

• Do not assume that “if the judge doesn’t see it, it doesn’t count.” Malicious prompts aimed at judicial AI are still part of your submission to the tribunal, and they reflect directly on your candor and honesty under Model Rules 3.3 and 8.4.

In short: if you would never say it to the judge in plain black‑and‑white text, you should not whisper it to the court’s AI in invisible text.

What To Watch For: How to Recognize This Behavior

lawyers need to be prepared to vet opposing counsel’s filings for ai injection!

The harder question is how you, as a solo or small‑firm lawyer, can spot similar tactics when others use them—especially when you don’t control the court’s systems.

Here are practical signals and questions:

• Suspicious formatting in PDFs or Word files. Odd spacing, unexpected blank pages, or inconsistent fonts can sometimes signal hidden layers of text. While you won’t always spot white‑on‑white content, unusual formatting should prompt closer inspection.

• Metadata anomalies. If you routinely examine document properties, look for multiple authors, unusual editing histories, or automation tags that do not match the face of the document. These can indicate heavy automated processing or embedded instructions.

• Patterns in AI‑mediated decisions. If certain filings—often from the same party—seem to sail through automated queues or receive unusually favorable, boilerplate orders, you may be seeing the downstream effect of prompt manipulation or aggressive “AI‑targeted” drafting.

Because you usually won’t have direct access to the court’s internal AI, you may need to raise these concerns procedurally: requesting clarification on how filings are screened, asking whether AI systems were involved in certain steps, or moving for relief if you believe your client’s matter was prejudiced by automated processing.

How To Protect Yourself and Your Clients:

Brazil’s experience is a warning shot—not just about bad actors, but about what a healthy response should look like.

Here’s how to translate that into a practical “do this, not that” playbook for your own practice:

1. Assume courts will adopt AI—and plan for it:

Brazil’s judiciary uses AI to prioritize cases, draft reports, and propose decisions in response to massive backlogs. U.S. courts are already experimenting with similar tools, even if not as publicly. Competence under Model Rule 1.1 now includes staying informed about these trends and understanding their implications.

2.     Build “AI integrity” into your litigation strategy.

• Treat any automated system that touches your filings—court e‑filing portals, online forms, AI‑assisted triage tools—as part of the tribunal.

• Resolve that you will never include hidden instructions, misleading metadata, or manipulative formatting in documents submitted to those systems.

3.     Advocate for transparent safeguards.

• In Brazil, authorities responded by exploring automatic detection of invisible text and stronger human oversight.

• When U.S. courts announce AI pilots or tools, comment on proposed rules, advocate for clear notice when AI is used, and request mechanisms for lawyers to challenge AI‑influenced outcomes.

4.     Document your own good‑faith use of AI.

it may be deemed a “fruad upon the court” if a lawyer injects ai into their electronic filings.

• If you rely on AI to format or generate parts of your filings, keep internal records of prompts, outputs, and human review.

• This documentation will help if a court or disciplinary body later asks how you ensured candor and accuracy, especially in a world where Brazil‑style abuses are making judges more skeptical.

Final Thoughts

AI isn’t just something we use; it’s now part of the institutional environment—just like e‑filing, CM/ECF, or digital signatures. The line between legitimate technology use and unethical manipulation is not about whether you use AI, but how you use it and whether you’re honest about it.

MTC

MTC: ChatGPT, Work Product, and Waiver: New Lessons from Tate Group Automotive ⚖️🤖

Tech‑savvy lawyerS need to be able to defend ChatGPT work product before Texas Business Court.

On June 3, 2026, the Business Court of Texas issued a minute entry in Tate Group Automotive, LLC v. Legacy Automotive Capital, LLC that every tech‑curious lawyer should know about. As of today, this is one of the first reported decisions to tackle whether a non‑lawyer’s ChatGPT conversations are protected attorney work product and, if so, whether using a public AI tool waives that protection.

The court’s answer is nuanced but important: generative AI does not automatically destroy work‑product protection, at least where the disclosure is not made to an adversary under Texas Rule of Civil Procedure 192.5(a)(1). For solos and small firms experimenting with AI tools, this is both reassuring and sobering.

What Happened in Tate Group Automotive?

The case arises from a dispute in the Texas Business Court’s Eleventh Division, in which Tate Group Automotive sued Legacy Automotive Capital, The Reynolds and Reynolds Company, and individual defendants. During discovery, the plaintiff withheld “Kris Tate–ChatGPT conversations” on the basis of attorney work‑product protection and submitted them to the court for in camera review.

Defendants challenged that claim. They argued that attorney work‑product protection does not extend to a non‑lawyer’s chats with an AI tool, or alternatively, that any protection was waived when Kris Tate used ChatGPT. They also asked the court to order the plaintiff to identify all discovery materials Mr. Tate or Tate Group had shared with ChatGPT.

Judge Grant Dorfman acknowledged that the issue was “novel,” noting that all case law cited by the parties dated from 2026 and that at least one opinion called the question “a first impression nationwide.” Against that backdrop, he evaluated the ChatGPT conversations under Texas Rule of Civil Procedure 192.5(a)(1), which defines work product and addresses waiver.

The key takeaway from the minute entry—based on the Minerva summary—is that the court concluded a non‑lawyer’s chats with ChatGPT did not automatically waive work‑product protection because the disclosure was not made to an adversary. That is a narrow holding, but it marks a significant moment in the emerging law of AI and privilege.

Why This Ruling Matters for Lawyers Using AI

At first glance, Tate Group may look like a niche discovery dispute. In reality, it answers a question many lawyers have quietly asked: “If my client uses ChatGPT, have we blown work product?”

The court’s answer is “not necessarily.” By focusing on whether the disclosure was made to an adversary, Judge Dorfman signaled that the waiver analysis for AI platforms should track the familiar contours of work‑product doctrine, at least in Texas. That gives practitioners a framework instead of a panic button.

At the same time, this is a minute entry in a specific context—not a blanket blessing for all AI use. The court still treated the issue as novel, still conducted in camera review, and still scrutinized how the AI tool was used. For lawyers, that means AI usage is now part of the discovery and privilege landscape, and courts will expect thoughtful, documented positions—not hand‑waving about “just using a tool.”

From an ABA perspective, this aligns with Model Rule 1.1 and Comment 8: competence now includes understanding the “benefits and risks associated with relevant technology,” including how generative AI intersects with privilege and work product. Model Rule 1.6 (confidentiality) and Rules 5.1/5.3 (supervision of lawyers and non‑lawyers) also come into play when clients or staff use tools like ChatGPT in ways that touch litigation strategy.

Lesson 1: Treat Client AI Use as Discoverable Reality, Not a Side Note

One of the most striking aspects of Tate Group is procedural: the court required in camera review of the ChatGPT conversations and entertained requests that plaintiff identify all discovery materials shared with ChatGPT. That tells us courts are prepared to treat AI interactions as real, reviewable artifacts in discovery.

If your clients or internal teams use AI to draft, summarize, or analyze case materials, those interactions can become part of the discovery conversation, just as drafts, notes, and emails have always been. Under Model Rules 1.1 and 1.6, you cannot stay competent or protect confidentiality if you do not know whether and how AI is being used on your matters.

Practically, that means:

• Ask clients early whether they have used tools like ChatGPT or other AI services to “get help” on their case.

• Document the scope and purpose of any AI use, especially if it involves draft pleadings, strategy, or privileged communications.

• Be prepared to defend or adjust your privilege and work‑product positions in light of those uses, as plaintiff did in Tate Group by asserting work‑product and submitting chats for in camera review.

Lesson 2: Public AI Platforms Are Not Automatic Waiver Machines

Solo attorneys need to protect their privileged work product from risky AI tools.

Defendants in Tate Group argued that a non‑lawyer’s chats with an AI tool either are not work product at all or, at minimum, effect a waiver. The court rejected the idea that simply using ChatGPT automatically destroys protection under Texas Rule 192.5(a)(1) when there is no disclosure to an adversary.

That matters, because there has been a real fear—sometimes stoked by vendors—that “if anyone touches ChatGPT, all privilege is gone.” This ruling shows courts can adopt a more nuanced view, at least under a work‑product framework.

For ABA‑Model‑Rules lawyers, this should not be read as a free pass. Model Rule 1.6 still requires reasonable efforts to prevent unauthorized disclosure of client information, and using a public AI platform can create confidentiality risk even if work product is technically preserved. But Tate Group suggests that waiver analysis will still look to core principles like whether disclosure reached an adversary.

In practice:

• You should not assume that any AI use destroys work product, but you should be ready to explain why your use did not involve disclosure to an adversary or the public.

• Engagement letters and internal policies should clarify whether and how you will use AI tools and what safeguards you apply, consistent with Model Rules 1.1, 1.4, and 1.6.

Lesson 3: In Camera Review Will Become Common for AI Disputes

The court’s process—ordering in camera review of the ChatGPT conversations before ruling—signals a likely pattern for AI‑related privilege disputes. Judges will want to see how AI was used, not just hear generalities, before deciding whether protection applies or has been waived.

That has three implications for practicing lawyers:

• You should assume that AI‑related materials can be reviewed by courts under appropriate safeguards.

• You need internal workflows to collect and present those materials when necessary without scrambling through chat histories.

• You should approach AI use with the expectation that a judge, someday, may read the raw prompts and outputs and ask whether your supervision met the standards of Model Rules 5.1 and 5.3.

This is a shift from treating AI as a “black box” helper to treating it as a discoverable component of your litigation process.

Lesson 4: Non‑Lawyers and AI Need Clear Supervision

In Tate Group, the conversations at issue were between Kris Tate—a non‑lawyer—and ChatGPT, yet they were withheld under an attorney work‑product theory. The court’s willingness to consider work‑product protection in that context underscores a point many of us have made: non‑lawyers can participate in the creation of protected material if they are acting at the direction of counsel.

But it also heightens the importance of supervision. Model Rule 5.3 requires lawyers to ensure that non‑lawyer assistants’ conduct is compatible with the lawyer’s professional obligations. When non‑lawyers use AI tools on client matters, they are effectively acting as an extension of the legal team.

Practical steps include:

• Training non‑lawyers on what they may and may not share with AI platforms.

• Setting clear rules about which tools are approved, for what purposes, and under whose supervision.

• Reviewing AI outputs and underlying prompts when they feed into litigation strategy, to ensure accuracy and compliance with Model Rules 3.3 and 4.1.

As we have discussed in episodes of The Tech‑Savvy Lawyer podcast, AI is not just a “lawyer tool”; it is often a staff and client tool. Your ethical obligations follow it wherever it goes. 💼🤖

Lesson 5: This Is Only the Beginning—But You Can Prepare

Texas judges along with others will be weighing ChatGPT privilege and waiver in generative AI era.

Judge Dorfman noted that all the case law cited by the parties dated from 2026 and that one authority called its ruling a “question of first impression nationwide.” That means we are at the very start of AI‑and‑privilege jurisprudence, not the end.

Every new decision—whether from Texas Business Courts or elsewhere—will refine the analysis. Some may take a stricter view of waiver for public AI tools; others may distinguish between work product and attorney‑client privilege. Regardless, Model Rule 1.1’s technology‑competence requirement demands that we follow these developments and integrate them into our practice.

You do not need to become an AI engineer, but you do need a plan:

• Inventory where AI is used in your matters (by you, your staff, your clients).

• Align that usage with your duties of competence, confidentiality, and supervision.

• Be prepared for in camera review of AI‑related materials, as in Tate Group.

• Update your engagement letters and internal policies to reflect reality, not wishful thinking.

If you approach AI as you approached email, e‑filing, and cloud storage when they were “new,” you will be ahead of many peers—and aligned with the spirit of both the ABA Model Rules and emerging case law.

MTC

MTC: Perplexity for Legal vs. Lexis, Westlaw, and vLex Fastcase: What Today's Lawyers Need to Know About Reliability, Cost, and Ethics

Tech-savvy lawyers need to HARNESs AI legal research tools!

If you practice law in 2026 and you're even mildly AI‑curious, you've probably seen the recent announcement of Perplexity for Legal, Perplexity's enterprise offering designed specifically for law firms and legal teams. 🧠 Now the field is more crowded than ever: Lexis+ AI/Protege, Westlaw Edge/Precision, and vLex Fastcase with Vincent AI are all vying for a place in your workflow—and Perplexity is asking a provocative new question: do you even need the legacy companies anymore? For solo and small‑to‑medium firm practitioners, the real question is simple. How does each of these platforms serve you in daily practice, and how do you choose responsibly?

What Perplexity for Legal Actually Offers

Perplexity's legal-focused enterprise product is built around its core strengths: fast, cited answers, deep multi‑source research, and the ability to connect to your firm's internal knowledge bases. You ask a question, see sources inline, and move from a synthesized answer directly into primary authority—or into firm work product—without hopping across multiple systems.

Highlighted use cases include:

• Staying current on legal developments across jurisdictions in real time.

• Generating client‑ready research memos faster.

• Drafting pitch materials and Request for Proposal responses by pulling context from internal documents.

Firms like Gunderson Dettmer report using Perplexity Enterprise to scale legal research on rapidly evolving topics such as emerging company financings and technology transactions. 🚀 Latham & Watkins uses it for market intelligence and tactical research. For solos and small firms, the benefit is more pragmatic: less time wrestling with search syntax, more time actually thinking like a lawyer.

If you're a regular reader and listener of The Tech-Savvy Lawyer.Page blog and podcast, we discuss this type of workflow can enhance your firm's productivity effectively and safely.

Meet the Field: Lexis, Westlaw, and vLex Fastcase

Before we stack Perplexity against the competition, it helps to understand what each incumbent actually is today—because the landscape has shifted considerably.

Lexis+ AI layers generative AI on top of LexisNexis's curated legal content and the powerful Shepard's citator. Its AI features are bundled into subscriptions that can run from the low hundreds to several hundred dollars per user per month, depending on coverage tier. Pricing is often opaque and driven by long-term contract negotiation rather than transparent published rates—a persistent frustration for small firms.

Westlaw Edge/Precision integrates Thomson Reuters' generative AI capabilities directly into the Westlaw research ecosystem, pairing them with KeyCite and deep editorial enhancements. Like Lexis, its pricing sits at the premium end of the market, and it is best suited for firms that already rely heavily on Westlaw's proprietary citator and editorial content.

vLex Fastcase is the most democratically accessible of the three. After Fastcase merged with vLex in 2023 and vLex was subsequently acquired by Clio, the combined platform now serves over one million lawyers nationwide through partnerships with 80+ state, county, and specialty bar associations—often as a free member benefit. At the heart of its AI offering is Vincent, vLex's AI legal assistant, which handles research, drafting, document analysis, and customizable workflows through a feature called Vincent Studio for enterprise teams. The platform's Cert citator flags negative treatment and authority, replacing the older Bad Law Bot, while AI Case Analysis generates automated headnotes and summaries. For many solos and small-firm practitioners, vLex Fastcase is effectively free through their bar membership—making it arguably the highest-value entry point in the market.

If you are a member of the Florida Bar, California Lawyers Association, Illinois State Bar, or any of the dozens of other partnered associations, you likely already have access to vLex Fastcase Premium (a $995/year value) at no additional charge.

Reliability: Can You Trust These Platforms for Legal Research?

today’s lawyers need to evaluate AI legal platforms, pricing, and ethics.

Reliability is the first concern I hear from lawyers when AI enters the conversation—something we cover on The Tech-Savvy Lawyer.Page. No AI platform is infallible, but they fail in different ways.

Lexis+ AI and Westlaw AI answer from within their proprietary, editorially curated databases. Their hallucination risk is constrained by the quality of their content backbones, but they can still misinterpret authority, overgeneralize from a line of cases, or overlook nuances between jurisdictions.

vLex Fastcase/Vincent answers from vLex's global legal database—over one billion searchable documents across 100+ countries—supplemented by its AI‑powered analysis layer. Vincent has performed strongly in independent AI benchmarking, including the Vals Legal AI Report and a comparative AI evaluation by law librarians. Its Cert citator provides direct verification, making it more trustworthy for authority checking than pure generative systems.

Perplexity for Legal draws from a broad web‑scale index plus any internal data you connect through the enterprise deployment. Its core reliability strength is the inline citation on virtually every statement—you can trace each claim back to a source immediately. Its Deep Research feature structures multi‑step investigations into organized reports with full sourcing. The honest limitation: Perplexity does not have a built-in citator or a curated legal content backbone like KeyCite or Cert. For final authority verification, you still need to confirm via Westlaw, Lexis, vLex Fastcase's Cert, or a reliable citator—no exceptions.

For all four platforms, the universal rule applies: AI answers are drafts, not final work product. Read the cases. Check the citations. Verify the authority. 📋

Ethics: ABA Model Rules and AI Research

Using any AI tool in legal practice implicates several ABA Model Rules, and the analysis is the same whether you use Perplexity, Lexis+ AI, Westlaw, or vLex Fastcase:

Rule 1.1 (Competence). Comment 8 requires lawyers to understand the benefits and risks of relevant technology. This means knowing how each tool generates its answers, where it can fail, and how to verify its output. You cannot delegate judgment to any AI—Perplexity, Vincent, or otherwise.

Rule 1.6 (Confidentiality). Enterprise deployments of Perplexity are designed to isolate firm data and not train public models on your inputs. vLex Fastcase, operating within the Clio ecosystem, also maintains firm-level data controls. Regardless of which platform you use, you must confirm the contractual and technical safeguards before loading confidential client information. Never use a consumer-grade tool without verified protections.

Rule 5.3 (Responsibilities Regarding Non-Lawyer Assistance). AI is, functionally, a non-lawyer assistant. You must supervise its use, review its output, and ensure that the work product it generates meets your professional obligations. Vincent Studio's custom workflows are an interesting development in this regard—they allow firms to embed review and compliance steps directly into AI workflows, which supports Rule 5.3 compliance by design.

Rule 1.4 (Communication). If AI tools materially change how you handle matters—especially in flat-fee engagements—consider whether to disclose that to clients. Doing so can build trust and align expectations.

These obligations are vendor‑agnostic. The ABA Model Rules care about your conduct, not your software logo. ⚖️

💰 Cost and Access: The Solo and Small‑Firm Reality

For solos and small‑to‑medium firms, cost is where decisions often get made. A realistic comparison in 2026 looks like this:

• Lexis+ AI: Bundled AI features run roughly $125–$275 per user per month at the low to mid-tier; enterprise tiers go significantly higher. Opaque pricing and long-term contracts are common complaints.

• Westlaw Edge/Precision: Premium pricing in the hundreds of dollars per month per user, with AI features integrated at the top tiers. Best suited for firms already embedded in the Westlaw ecosystem.

• vLex Fastcase: Free to bar association members for the core plan, with a retail value around $995 per year. Vincent AI premium features (50-state surveys, drafting tools) require a paid upgrade, but bar members often get discounted access. For many solos, this is already sitting in their inbox—they just haven't activated it.

• Perplexity for Legal (Enterprise): Enterprise pricing is generally more transparent and leaner than full Lexis/Westlaw stacks. Exact per-seat pricing varies by deployment, but it is positioned as an accessible AI layer rather than an all-in-one legal publisher.
  
  💡 Tip: Solos and Small Firms, check out if the Enterprise Pro plan meets you needs - Perplexity Enterprise Pro runs a fraction of the cost of Lexis+ AI or Westlaw Precision—platforms that can run $125–$275 per user per month or more—making it one of the most cost-competitive AI research tools available to solo and small-firm practitioners today.

The practical calculus for solos and small firms:

• If you already have Lexis or Westlaw, Perplexity can complement them for early-stage research, cross-domain intelligence, and drafting.

• If you have vLex Fastcase through your bar, you already have a solid free primary law backbone with built-in AI. Pairing that with Perplexity Enterprise gives you AI synthesis capabilities across web-scale sources at a potentially lower total cost than upgrading to premium Lexis or Westlaw AI tiers.

• If you are starting from scratch, the vLex Fastcase bar benefit plus a Perplexity Enterprise subscription may deliver more value per dollar than any single legacy vendor stack. 💸

That is not a recommendation to ditch Lexis or Westlaw wholesale—their curated content and citator infrastructure remain industry benchmarks. It is a recommendation to audit what you actually use and design a deliberate stack around it.

A Practical Framework for Choosing and Using These Tools

tech-savvy lawyers need to compare modern ai- vs legacy- legal research tools.

• Keep Lexis/Westlaw if you heavily use KeyCite/Shepard's, proprietary treatises, or sophisticated editorial enhancements.

• Activate vLex Fastcase through your bar if you haven't already—it's free for most practitioners and now includes genuine AI capabilities via Vincent.

• Use Perplexity for Legal for early-stage issue spotting, multi-jurisdiction surveys, cross-domain research, and AI-assisted first drafts of memos and correspondence.

• Anchor everything in the ABA Model Rules:

  • Competence: know how each tool works and where it fails.

  • Confidentiality: enterprise deployments only, with verified data protections.

  • Supervision: treat all AI output as a first draft to be reviewed and verified.

• Write an internal AI use policy specifying which tools are authorized, for which tasks, and how outputs are verified and documented.

The question is never "Which one wins?" It's "How do I build a balanced, ethical, cost-conscious research stack that serves my clients well?" That's what it means to be a truly tech-savvy lawyer. 💼

BOLO: Rokarolla Android Banking Malware Is Hunting Lawyers’ Phones—and Your Trust Accounts

A Tech-savvy lawyer needs to shield client banking data from Android malware attack.

If you use an Android phone for client communications or online banking, it’s time to treat Rokarolla as a real and present danger—not as abstract “security news.” 🚨 This newly uncovered Android malware can silently take over your device, steal your banking logins, and hijack your screen to trick you into handing it the keys to your operating and trust accounts.

Rokarolla is a banking Trojan that abuses Android’s accessibility services and screen overlay capabilities to place fake login pages on top of your legitimate banking apps. The malware is distributed mainly through malicious websites that push users to download “free” or “updated” apps outside the Google Play Store—classic sideloading traps. Once on your phone, Rokarolla can read what’s on your screen, simulate taps, and siphon off your credentials, all while you think you’re securely logging in.

For solo and small‑firm lawyers who often use one device for everything—email, texting, banking, client portals—the risk is amplified. If Rokarolla compromises the phone you use for trust-account access or client billing, your exposure isn’t just financial. It’s ethical. Under ABA Model Rule 1.1, competence today includes understanding the “benefits and risks associated with relevant technology.” Failing to take basic steps to prevent a known mobile banking threat can be viewed as a failure to exercise reasonable competence in safeguarding client property and information.

Rokarolla’s core move is deceptively simple. After infection, it requests broad accessibility permissions. If granted, it can:

Solo attorney need to confront malicious Android apps threatening law firm finances.

• Observe what appears on your screen, including banking and financial apps.

• Capture input events such as taps, swipes, and text entry.

• Draw fake overlays that look like your bank’s login page, convincing you to “re‑authenticate.”

When you type your username, password, or two‑factor codes into this fake screen, Rokarolla sends that data back to its operators, who can then access your real accounts. For a law firm, that could mean unauthorized wire transfers from your trust account, tampering with payroll, or manipulating client refunds—exactly the sort of nightmare that triggers ethics complaints and malpractice claims. 😬

Under ABA Model Rule 1.6, you have an affirmative duty to protect client confidentiality. Client financial data, settlement funds, and trust balances accessed via mobile banking apps fall squarely within that obligation. Using an Android device that you know—or should know—is vulnerable to current banking malware without implementing countermeasures may be viewed as a failure to “make reasonable efforts” to prevent unauthorized access. Integrating mobile security into your practice isn’t optional risk management. It’s part of your professional duty of care.

So what should you do—today—to stay ahead of Rokarolla and similar Android banking Trojans?

1. Stop sideloading apps. Only install apps from the Google Play Store and avoid downloading Android Package Kits from websites, emails, or messaging apps, no matter how “official” they look.

2. Scrutinize permissions. When any app asks for accessibility or overlay permissions (for example, “display over other apps”), treat that as a red flag unless you fully understand why it’s needed.

3. Use a reputable mobile security app. Tools like Malwarebytes for Android can detect and remove many known banking Trojans, including emerging families similar to Rokarolla.

4. Enable strong multi‑factor authentication (MFA). Use app‑based authenticators instead of SMS codes when possible, and never share MFA codes with anyone who contacts you “from the bank.”

5. Segregate devices for sensitive banking. Consider using a dedicated, locked‑down phone or tablet for trust‑account access and keep that device free of social media, gaming, and experimental apps.

6. Train your team. Under ABA Model Rule 5.1 and 5.3, supervising attorneys must ensure that staff and nonlawyer assistants follow security policies. Make Android banking security part of your standard onboarding and training.

Law firm teams need to review Android security checklist to protect trust accounts.

These steps are not extreme. They are the mobile equivalent of locking your office door and using a shredder. They also help you satisfy your duty of reasonable cybersecurity under ethics opinions like ABA Formal Opinion 477R, which emphasizes the need to match your security practices to the sensitivity of client information. When the stakes involve trust accounts, settlement funds, or client escrow, anything less than actively defending your mobile banking environment is inadequate.

The bottom line: treat your Android device as a first‑class part of your practice infrastructure. Rokarolla and its cousins are designed to exploit lawyers who assume their phones are “personal” and therefore outside the security conversation. As a tech‑savvy lawyer, you know better. Your ethics obligations follow your data wherever it goes—including into your pocket.

Stay Safe Out There!