CyberDakait Android malware campaign compromises 17,960 devices of Indian banking customers via vishing and GitHub-hosted APKs
1 fonte(s)
·
1 atualização(ões)
·
publicado 29/10/2026 02:26
·
coletado há 3 dias
CyberDakait is a financially motivated Android malware operation that has targeted Indian banking customers since July 2025, according to Group-IB. Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages. The campaign combines banking credential theft, remote device control and Monero mining. Attackers impersonate 11 Indian banking institutions and two government programs. Group-IB clusters seven malware families under the operation because of overlapping distribution methods, phishing infrastructure and financial objectives.
Detalhes técnicos
- Lure: Victims receive fraudulent calls and messages from supposed bank representatives, often about canceling an allegedly activated Credit Card Protection Plan. They are directed to bank-themed phishing sites that require installing an Android app to "cancel".
- Distribution: Malicious APKs are hosted in GitHub repositories. After installation, a fake Google Play update screen prompts a second payload, and the app asks the user to disable battery optimization.
- Data theft: The phishing flow collects card numbers, expiry dates, CVVs, internet banking credentials, card grid values, identity details and photographs. Intercepted OTPs, transaction alerts, PAN and Aadhaar data are also exposed.
- Payloads: The initial app is a dropper that delivers remote-access functionality and an XMRig-based miner. Payloads are encrypted with AES/CBC/PKCS5Padding. Persistence relies on wake locks, silent audio playback and foreground services.
- Malware families: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat and tenxen. Group-IB ties GhostGrab to an older GhostBat version and tracks them as one family. Related Seqrite research describes d-miner mining Monero only while devices are locked.
- C2 and exfiltration: Telegram bots, Firebase databases and remote HTTP backends. A GitHub-hosted cyb3rx admin APK exposed an operator dashboard with victim monitoring, SMS forwarding, call-forwarding commands and remote SMS sending.
- Victim count: 2,364 unique device UUIDs from 2,805 installation notifications, plus 15,596 devices from exposed Firebase infrastructure, give the 17,960 total. Earlier Cyble and CYFIRMA reports on GhostBat and GhostGrab give technical context but do not independently establish CyberDakait attribution.
Remediação
- Install banking apps only from verified channels and treat unsolicited calls about card protection plans as fraud.
- Look for suspicious APK installs, unexpected SMS permissions, fake update screens and persistent background services.
- Review app permissions, enable Play Protect and investigate unexplained overheating or battery drain.
- Contact the bank immediately after suspected exposure.
Linha do tempo
-
CyberDakait Android malware campaign compromises 17,960 devices of Indian banking customers via vishing and GitHub-hosted APKs
ler a análise desta fonte ocultar
CyberDakait is a financially motivated Android malware operation that has targeted Indian banking customers since July 2025, according to Group-IB. Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages. The campaign combines banking credential theft, remote device control and Monero mining. Attackers impersonate 11 Indian banking institutions and two government programs. Group-IB clusters seven malware families under the operation because of overlapping distribution methods, phishing infrastructure and financial objectives.
Technical Details
- Lure: Victims receive fraudulent calls and messages from supposed bank representatives, often about canceling an allegedly activated Credit Card Protection Plan. They are directed to bank-themed phishing sites that require installing an Android app to "cancel".
- Distribution: Malicious APKs are hosted in GitHub repositories. After installation, a fake Google Play update screen prompts a second payload, and the app asks the user to disable battery optimization.
- Data theft: The phishing flow collects card numbers, expiry dates, CVVs, internet banking credentials, card grid values, identity details and photographs. Intercepted OTPs, transaction alerts, PAN and Aadhaar data are also exposed.
- Payloads: The initial app is a dropper that delivers remote-access functionality and an XMRig-based miner. Payloads are encrypted with AES/CBC/PKCS5Padding. Persistence relies on wake locks, silent audio playback and foreground services.
- Malware families: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat and tenxen. Group-IB ties GhostGrab to an older GhostBat version and tracks them as one family. Related Seqrite research describes d-miner mining Monero only while devices are locked.
- C2 and exfiltration: Telegram bots, Firebase databases and remote HTTP backends. A GitHub-hosted cyb3rx admin APK exposed an operator dashboard with victim monitoring, SMS forwarding, call-forwarding commands and remote SMS sending.
- Victim count: 2,364 unique device UUIDs from 2,805 installation notifications, plus 15,596 devices from exposed Firebase infrastructure, give the 17,960 total. Earlier Cyble and CYFIRMA reports on GhostBat and GhostGrab give technical context but do not independently establish CyberDakait attribution.
Remediation
- Install banking apps only from verified channels and treat unsolicited calls about card protection plans as fraud.
- Look for suspicious APK installs, unexpected SMS permissions, fake update screens and persistent background services.
- Review app permissions, enable Play Protect and investigate unexplained overheating or battery drain.
- Contact the bank immediately after suspected exposure.