Indian credit card holders are getting a phone call within a day of their new card arriving. A caller posing as the bank says a "Credit Card Protection Plan" has been switched on and will cost them somewhere between about $5 and $150 unless they cancel it now. The cancellation link installs Android malware that steals their card details, their banking login and the text messages they receive.
Group-IB's Threat Intelligence team has mapped the operation behind those calls in the original report. It tracks the financially motivated cluster as CyberDakait, counts at least 17,960 compromised devices and 7,611,443 intercepted SMS messages, and has identified seven distinct Android malware families used against customers of 11 Indian banks and two government programs.
A cancellation form that empties the account
Victims receive a WhatsApp link to a bank-themed phishing page. Tapping any button on it, such as "Login Now" or "Activate Protection", silently downloads an APK hosted on GitHub, where Group-IB found repositories serving hundreds of malicious apps impersonating different lenders. Hosting on GitHub lends the files credibility and complicates takedowns.
Once installed, the app shows what looks like its own Google Play update page while it quietly installs a different app in the background, and asks the user to turn off battery optimization so Android will not stop it. The fake "deactivation" then walks the victim through four steps: card number, expiry and CVV; net banking credentials and the grid numbers on the back of the card, framed as a KYC check; mobile number, PAN and date of birth; and finally a photo of the front of the card.
All of the trojans intercept and forward SMS, forward phone calls and steal card data through phishing overlays, a combination that defeats the one-time passwords banks send by text. Group-IB says intercepted messages included OTPs and transaction alerts as well as card details, PAN and Aadhaar numbers, forwarded to attacker-controlled Telegram bots and Firebase databases in near real time.
Seven families, one playbook, and a crypto miner on the side
The first-stage APK is a dropper that fetches the main payload alongside a mining module Group-IB calls d-miner, which runs XMRig on the victim's phone. The operators earn twice: from fraud, and from the device's processing power.
Group-IB classifies the payloads as cyb3rx, appkjl, godz, d-passive, d-shine, tenxen and GhostBat, and concludes that the previously reported GhostGrab is an older version of GhostBat. The families share a packer, phishing themes and capabilities but differ in their network traffic, database layouts and Telegram message formats, which Group-IB reads as evidence of independent development. It says it could not determine definitively whether every trojan the dropper delivers belongs to the same threat actor.
The researchers also found a GitHub repository holding an administrative controller app for the cyb3rx family, which operators use to watch victims, switch SMS forwarding on and off, and send commands such as call forwarding and custom USSD codes. Screenshots shared by GhostBat developers on Telegram in 2024 show the malware being written and compiled on Android phones rather than on desktop machines.
The losses are real. Group-IB cites reported cases totalling more than $30,500 from calls about card protection plans, and says victim reports place the scheme in India since at least January 2025. Its own observation of the campaign against the financial sector runs from July 2025.
No bank cancels a plan through an APK
There is no patch for social engineering. Customers should treat any call about an unrequested charge on a new card as suspect, hang up and call the number printed on the card, and never install an app from a link sent over WhatsApp or SMS. Banks and CERTs can hunt for the controller infrastructure Group-IB published:
- C2: hxxp://64[.]89[.]163[.]3/idfc/1/api/
- C2: hxxp://64[.]89[.]163[.]3/pnb/1/api/
- GitHub repository hosting the cyb3rx controller: ranidevisingh901-debug/gsafsdfsdf
Android banking malware has been a steady theme this year, from a dropper that switches off Play Protect to AI-driven trojans that steal PINs, and India is one of its biggest targets. CyberDakait shows how far that has matured: not one trojan but a supply of them, timed to the day a new card lands.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.