{
  "id": 17615447,
  "title": "MR ROBOT malware network targets bank customers across India",
  "url": "https://urgent.news/2026/11/01/mr-robot-malware-network-targets-bank-customers-across-india",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T14:05:22.000Z",
  "source": {
    "name": "Arabian Post",
    "slug": "arabian-post",
    "url": "https://thearabianpost.com/mr-robot-malware-network-targets-bank-customers-across-india/"
  },
  "original_language": "en",
  "account": "An Android malware operation known as MR ROBOT is targeting bank customers in India, according to a report published on October 28th by cybersecurity firm CloudSEK. The malware creates fraudulent applications that intercept security codes, steal financial credentials, and divert verification calls.\n\nCloudSEK identified the operation after analyzing an exposed database and management software. One affiliate controlled 153 compromised devices, intercepting 5,407 text messages. Approximately 4,000 of these messages were related to banking and telecommunications short codes, including one-time password communications.\n\nResearchers discovered call forwarding enabled on 58% of affected devices, which could redirect banks' verification calls to criminal-controlled numbers. The malware also features a mechanism to interfere with call verification processes.\n\nWhile the exact number of victims and financial losses are unknown, the investigation revealed that certain builds of the malware delay malicious activity for up to 48 hours before activating. Other versions conceal their application icons and employ separate signing certificates to evade detection.\n\nThe malware uses encrypted components and can transmit stolen information to Firebase databases operated by individual affiliates. Researchers identified a Cloudflare-hosted management infrastructure and temporary network tunnels used to obscure the underlying server. This design means disrupting one affiliate's collection point would not necessarily disable every participant.\n\nThe operation uses a rental model, where customers obtain individual application identifiers, a management dashboard, and select a bank to create a custom, malicious Android installation package. Administrative features allow affiliates to resell access to the service.\n\nA Telegram-based storefront offered approximately 36 deceptive applications, including impersonations of nine banks and utilities. Some applications impersonate Aadhaar updates or know-your-customer verification procedures, using familiar administrative requests to persuade users to install the malicious software outside of official application stores.\n\nOnce installed, the trojan captures incoming text messages, displays counterfeit forms, and extracts sensitive information such as Aadhaar and PAN numbers, payment-card details, security codes, ATM PINs, UPI PINs, and online banking credentials. The malware's call-diversion function adds another layer to the attack by forwarding incoming calls away from the account holder.",
  "summary": "A subscription-based Android malware operation is targeting bank customers across India, allowing criminals to create fraudulent applications that intercept security codes, steal financial credentials and divert verification calls. Cybersecurity company CloudSEK identified the operation, named MR ROBOT, in an investigation published on 28 October. Its findings show that one affiliate controlled…",
  "key_points": [
    "MR ROBOT malware targets Indian bank customers",
    "Malware intercepts security codes and steals credentials",
    "Call diversion feature diverts verification calls"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}