MR ROBOT Android banking trojan MaaS targets Indian bank customers; 5,407 SMS intercepted from 153 devices
CloudSEK reported on October 28 a new Android malware-as-a-service operation, MR ROBOT, that rents customized banking trojans to criminal affiliates targeting Indian bank customers. It is a multi-tenant crimeware platform, not a single actor's campaign, and includes an operator control panel (version 7.0), a Telegram storefront called APK Shield and a malware builder. Lures are delivered through fake Play Store-style pages and messaging-app links, and impersonate banks, utility providers and government services. CloudSEK tracked two affiliates; an exposed Firebase database tied to one held 153 devices and 5,407 intercepted text messages collected between July 16 and 30, 2026.
Detalhes técnicos
- Each affiliate gets its own application ID and can build Android packages impersonating specific Indian banks. The platform supports a tiered reseller model with sub-admin accounts and time-limited licenses.
- The malware intercepts SMS carrying OTPs and shows fake screens to harvest banking credentials, card details, PINs and identity information.
- It can silently enable call forwarding, rerouting incoming calls, including banks' fraud-check callbacks, to attacker-controlled numbers. Forwarding was active on 58% of the devices observed.
- Each build receives a fresh signing certificate and can hide from the Android launcher after installation.
- APK Shield offered about 36 lure apps: bank impersonations and fake apps for utility bills, telecom services, traffic fines and government services.
- One affiliate panel held about 154 enrolled devices and about 3,270 intercepted messages; about 4,000 messages in the other dataset came from bank and telecom short codes.
- CloudSEK notes MR ROBOT shares call forwarding and per-customer builders with FatBoyPanel and RedWing (previously documented by Zimperium), but its kit, storefront and panel had not been publicly reported.
Remediação
- Never install bank-branded apps from links received via text, WhatsApp or Telegram.
- Banks should move customers from SMS-based OTPs to app-based or FIDO authentication where feasible.
Linha do tempo
-
MR ROBOT Android banking trojan MaaS targets Indian bank customers; 5,407 SMS intercepted from 153 devices
ler a análise desta fonte ocultar
CloudSEK reported on October 28 a new Android malware-as-a-service operation, MR ROBOT, that rents customized banking trojans to criminal affiliates targeting Indian bank customers. It is a multi-tenant crimeware platform, not a single actor's campaign, and includes an operator control panel (version 7.0), a Telegram storefront called APK Shield and a malware builder. Lures are delivered through fake Play Store-style pages and messaging-app links, and impersonate banks, utility providers and government services. CloudSEK tracked two affiliates; an exposed Firebase database tied to one held 153 devices and 5,407 intercepted text messages collected between July 16 and 30, 2026.
Technical Details
- Each affiliate gets its own application ID and can build Android packages impersonating specific Indian banks. The platform supports a tiered reseller model with sub-admin accounts and time-limited licenses.
- The malware intercepts SMS carrying OTPs and shows fake screens to harvest banking credentials, card details, PINs and identity information.
- It can silently enable call forwarding, rerouting incoming calls, including banks' fraud-check callbacks, to attacker-controlled numbers. Forwarding was active on 58% of the devices observed.
- Each build receives a fresh signing certificate and can hide from the Android launcher after installation.
- APK Shield offered about 36 lure apps: bank impersonations and fake apps for utility bills, telecom services, traffic fines and government services.
- One affiliate panel held about 154 enrolled devices and about 3,270 intercepted messages; about 4,000 messages in the other dataset came from bank and telecom short codes.
- CloudSEK notes MR ROBOT shares call forwarding and per-customer builders with FatBoyPanel and RedWing (previously documented by Zimperium), but its kit, storefront and panel had not been publicly reported.
Remediation
- Never install bank-branded apps from links received via text, WhatsApp or Telegram.
- Banks should move customers from SMS-based OTPs to app-based or FIDO authentication where feasible.