Rent-a-trojan kit targets Indian bank customers

Published

A new Android malware operation is selling bank fraud as a subscription. CloudSEK researchers say MR ROBOT lets paying affiliates order a custom banking trojan for a chosen Indian bank through a Telegram bot, then watch stolen one-time passwords, card numbers and UPI PINs arrive in a web dashboard.

CloudSEK threat researcher Bhavik Malhotra detailed the operation in the original report. CloudSEK describes it as a previously unreported malware-as-a-service platform rather than a single crew: a master operator leases access to affiliates, who get a licence ID with an expiry date, a versioned control panel (v7.0) and an on-demand builder.

A menu of about 36 fake apps

The Telegram bot, which calls itself "APK Shield", offers a catalog of roughly 36 ready-made lure apps on a demo-then-paid model. CloudSEK counted nine public and private sector bank impersonations, plus fake gas, water and electricity billers, a telecom recharge lure, and several "RTO Challan" traffic-fine apps that charge a ₹9 to ₹10 "fee" to harvest name, PAN, date of birth and mobile number. The bot also mints fake Play Store style install pages so victims can install "directly without searching".

The investigation began with one APK impersonating a public sector bank under an "Aadhaar update" lure, which plays on India's mandatory KYC re-verification notices. It turned out to be a single item on that menu.

Silent call forwarding beats the bank's callback

Once sideloaded, a lightweight dropper decrypts an AES-encrypted second stage and installs the real trojan under a randomized package name, with no launcher icon. Before doing so it checks for emulators and waits for several launches and at least 48 hours, long enough to outlast a sandbox that watches a sample for minutes.

The trojan reads incoming SMS to capture OTPs and quietly turns on unconditional call forwarding with the carrier code *21*<number>#, which reroutes the victim's incoming calls, including a bank's fraud-check callback, to a number the criminals control. HTML overlays then collect Aadhaar, PAN, card number and CVV, ATM PIN, UPI PIN and net banking credentials, with a fake "verification fee" step to confirm the card works. Stolen data flows to a Firebase Realtime Database and a Telegram channel.

Every build is signed with a throwaway certificate, so blocklisting certificate hashes will not catch new ones, CloudSEK says. But the command server is tied to the affiliate rather than the lure: trojans for two different banks carried a byte-identical Firebase configuration, so taking down one Firebase project would cut off an affiliate's whole product line.

Hundreds of victims per tenant

The tenant CloudSEK tracked, Affiliate A, showed about 154 enrolled devices and about 3,270 intercepted messages in its panel. A second tenant with an exposed database, Affiliate B, held 153 devices and 5,407 intercepted SMS captured between 16 and 30 July 2026, peaking at 562 messages in a single day, with call forwarding active on 58% of victims and OTPs harvested from more than a dozen banks and payments banks. The victims are ordinary Indian Android users, mostly on budget handsets, with SIMs across all four major carriers.

CloudSEK says MR ROBOT shares tradecraft with FatBoyPanel and RedWing, two India-focused operations documented by Zimperium, notably the *21# forwarding and per-customer builders, and calls a shared lineage an open question. Its specific kit, panel, storefront and licensing scheme had not appeared in public threat intelligence reporting before.

Refuse sideloaded apps, then check call forwarding

The trojan has to be sideloaded, so the first defence is refusing to install apps from links in WhatsApp or SMS messages, however official the install page looks. Anyone who has installed a bank or Aadhaar "update" from such a link should check their phone's call forwarding settings and contact their bank. Defenders can hunt for the indicators CloudSEK published:

MR ROBOT joins a crowded field of Android fraud aimed at India, following earlier cases such as an AI-driven trojan that steals bank logins and PINs. What changes here is the business model: the people stealing the money no longer need to build anything.

This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.

Read the full analysis on IntelFusions