A newly uncovered Android malware rental operation is targeting Indian bank customers with fake KYC, banking and government apps designed to steal OTPs, financial credentials and identity data.
Cybersecurity firm CloudSEK has identified the operation as MR ROBOT, a Malware-as-a-Service platform that allows cybercriminals to rent customised banking trojans instead of developing their own malware.
Researchers say the service includes an APK builder, control panel, Telegram storefront and affiliate system.
One exposed affiliate database contained 153 infected devices and 5,407 intercepted SMS messages, showing that the operation has already been used against real victims.
Fake Aadhaar and Banking Apps Deliver the Trojan
CloudSEK began investigating MR ROBOT after analysing a malicious Android application impersonating a public-sector bank.
The app was distributed as an “Aadhaar Update” tool, exploiting routine KYC and identity-verification requests that Indian banking customers are familiar with.
Once installed, the first-stage application decrypts and installs a second payload containing the actual banking trojan.
The malware then requests permissions allowing it to read SMS messages, send messages, make calls and remain active after the phone restarts.
Fake screens are used to collect Aadhaar and PAN details, card numbers, CVVs, ATM PINs, UPI information and net-banking credentials.
The stolen information can then be sent to infrastructure controlled by the attacker.
CloudSEK says the operation also offers fake apps impersonating utility companies, telecom services, traffic challan portals and government-related services.
Its Telegram catalogue contained roughly 36 different lure applications.
Call Forwarding Helps Attackers Bypass Bank Checks
One of MR ROBOT’s more dangerous features is its ability to activate unconditional call forwarding.
The malware uses the carrier code *21*<number># to redirect incoming calls to a number controlled by the attacker.
That matters because banks sometimes call customers to verify suspicious transactions.
If those calls are diverted, the fraudster may receive them instead of the account holder.
CloudSEK found call forwarding active on around 58% of devices in one exposed affiliate database.
The same database showed 5,407 intercepted SMS messages across 153 devices.
Researchers said intercepted messages included OTPs associated with more than a dozen banks and payments banks.
The malware can therefore combine stolen login credentials with intercepted authentication messages and redirected calls.
That gives attackers several ways to bypass normal banking safeguards.
Malware Sold Like a Subscription Service
MR ROBOT is not described as a single attacker using one malware sample.
CloudSEK says it functions as a commercial crimeware platform.
A master operator rents access to affiliates using individual App IDs.
Those affiliates can then generate customised malicious APKs using an automated builder.
The panel also contains options for creating sub-administrators, setting login limits and managing different victim campaigns.
A Telegram bot branded “APK Shield” acts as the storefront.
Affiliates can use it to generate malicious download links and choose from ready-made fake applications.
The system also appears to use licence expiry dates, suggesting customers must periodically renew access.
This lowers the technical barrier for cybercriminals.
An affiliate does not need to write Android malware from scratch.
Instead, the infrastructure, malware builder and victim-management tools are supplied as part of the service.
Malware Uses Several Tricks to Avoid Detection
CloudSEK found multiple techniques designed to make MR ROBOT harder to identify.
Each malware build can receive a different signing certificate, making simple certificate-based blocking less effective.
The installer also checks whether it is running inside an emulator, which is commonly used by security researchers.
Some builds wait for at least 48 hours and several launches before activating fully.
That can allow them to avoid automated sandboxes that analyse suspicious applications only for a short period.
After installation, the malicious application can also remove its launcher icon.
This makes it less obvious to victims that the app remains installed.
Researchers additionally identified a local VPN component and encrypted second-stage payloads designed to complicate analysis.
Stolen information can be sent to Firebase Realtime Database infrastructure, while Telegram provides another communication channel.
The operator also uses disposable Cloudflare infrastructure to make its backend harder to locate.
One Affiliate Recorded Thousands of Intercepted Messages
CloudSEK tracked data belonging to at least two separate affiliates.
One affiliate showed around 154 enrolled devices and roughly 3,270 intercepted messages in its control panel.
A second exposed database contained 153 devices and 5,407 SMS messages.
CloudSEK said the second dataset represented a more mature affiliate operation.
At peak activity, around 400 messages were reportedly being intercepted each day.
Researchers stressed that the figures relate to individual affiliates rather than the entire MR ROBOT ecosystem.
The total number of infected devices is therefore unknown.
The report also does not establish the total amount of money stolen through the malware.
Why Fake APKs Remain Dangerous in India
MR ROBOT relies heavily on users installing applications from links sent through messaging platforms rather than downloading them from trusted app stores.
This technique remains common in Indian cyber fraud.
Victims may receive an APK presented as a KYC update, bank verification tool, traffic challan notice or utility payment application.
Android users who install such files manually may bypass protections designed to screen apps before installation.
Once permissions are granted, a malicious app can potentially read messages, redirect calls or display convincing fake login screens.
CloudSEK says the platform’s design also means different criminals can quickly reuse the same malware against different banks and services.
What this means for you:
Never install banking, KYC, challan or government APK files received through WhatsApp, Telegram or SMS. If an app asks for SMS, call or installation permissions unexpectedly, stop and verify the request through the organisation’s official website or app.
