MR ROBOT malware network targets bank customers across India

An Android malware operation known as MR ROBOT is targeting bank customers in India, according to a report published on October 28th by cybersecurity firm CloudSEK. The malware creates fraudulent applications that intercept security codes, steal financial credentials, and divert verification calls.

CloudSEK identified the operation after analyzing an exposed database and management software. One affiliate controlled 153 compromised devices, intercepting 5,407 text messages. Approximately 4,000 of these messages were related to banking and telecommunications short codes, including one-time password communications.

Researchers discovered call forwarding enabled on 58% of affected devices, which could redirect banks' verification calls to criminal-controlled numbers. The malware also features a mechanism to interfere with call verification processes.

While the exact number of victims and financial losses are unknown, the investigation revealed that certain builds of the malware delay malicious activity for up to 48 hours before activating. Other versions conceal their application icons and employ separate signing certificates to evade detection.

The malware uses encrypted components and can transmit stolen information to Firebase databases operated by individual affiliates. Researchers identified a Cloudflare-hosted management infrastructure and temporary network tunnels used to obscure the underlying server. This design means disrupting one affiliate's collection point would not necessarily disable every participant.

The operation uses a rental model, where customers obtain individual application identifiers, a management dashboard, and select a bank to create a custom, malicious Android installation package. Administrative features allow affiliates to resell access to the service.

A Telegram-based storefront offered approximately 36 deceptive applications, including impersonations of nine banks and utilities. Some applications impersonate Aadhaar updates or know-your-customer verification procedures, using familiar administrative requests to persuade users to install the malicious software outside of official application stores.

Once installed, the trojan captures incoming text messages, displays counterfeit forms, and extracts sensitive information such as Aadhaar and PAN numbers, payment-card details, security codes, ATM PINs, UPI PINs, and online banking credentials. The malware's call-diversion function adds another layer to the attack by forwarding incoming calls away from the account holder.