False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps

Introduction

Group-IB’s Threat Intelligence team has uncovered a sophisticated Android malware campaign that has been systematically targeting India’s financial services sector since July 2025. It is orchestrated by a financially-motivated threat cluster tracked by Group-IB as CyberDakait. The main goal of the campaign is the distribution of Android malware to conduct cryptojacking and elaborate banking fraud.

The malicious samples identified in this research comprise 7 distinct malware families, each deployed through coordinated smishing and vishing campaigns that lure victims into installing malicious APKs by impersonating legitimate bank representatives. They are designed to harvest sensitive information including bank mobile application credentials, credit card details, outstanding balances, through sophisticated overlay attacks.

The malicious applications are commonly hosted on GitHub repositories to maintain legitimacy and evade security controls, where the initial APK functions as a dropper that downloads and executes the main payload alongside a cryptocurrency mining module, enabling the threat actors to generate revenue through both direct financial theft and unauthorized cryptocurrency mining on infected devices.

Key discoveries

• Victims are strategically lured through coordinated smishing and vishing campaigns impersonating bank representatives.
• A total of 11 Indian banking institutions and 2 government programs have been observed to be impersonated by the operators of this campaign.
• The identified application asks for sensitive details like mobile banking app login credentials, credit card details including front & back photos, outstanding balance.
• The discovered APK is commonly hosted on GitHub, and acts as a dropper for the main payload, as well as a crypto-mining module.
• Identified 7 different malware families; each family utilizes distinct infrastructure for C2 communication and data exfiltration – Firebase, Telegram bots, remote backend.
• Additionally, a GitHub repository was discovered hosting an administrative controller APK for one of the malware families, allowing threat actors to track victims and issue C2 commands.
• A total of at least 17,960 compromised devices has been identified across all exfiltration channels combined.
• Group-IB analysis revealed a total of 7.6 million SMS messages intercepted from victim devices.
• Threat actors utilize Android-based mobile devices for malware development and leverage a dedicated administrative controller APK to monitor victims and issue C2 commands.

Who may find this blog interesting:

• Cybersecurity analysts and corporate security teams
• Malware analysts
• Threat intelligence specialists
• Computer Emergency Response Teams (CERT)
• Law enforcement investigators
• Regional Cyber Police teams

Group-IB Threat Intelligence Portal: CyberDakait

Group-IB customers can access our Threat Intelligence portal for more information about CyberDakait and malware profiles detailed in this blog:

• Threat Intelligence Report
• CyberDakait
• GhostBat
• cyb3rx
• d-passive
• d-shine
• tenxen
• appkjl

Campaign Description

Based on public disclosures from individuals targeted by this scheme, victims frequently report receiving fraudulent phone calls concerning a “Credit Card Protection Plan” (CPP) shortly after their new credit cards are issued. This campaign has been active in India since at least January 2025, based on documented victim reports, and shows no signs of slowing. The consistency of scripts, phishing infrastructure, and independent victim reports suggests an organized operation, though no specific threat group has been formally attributed.

The caller poses as a bank representative and claims a CPP has been automatically activated, with charges ranging from roughly $5 to $150 unless the plan is “deactivated” immediately. Victims are then directed to a phishing website and prompted to download a malicious APK under the guise of completing the deactivation.

Figure 1: Example of a public victim’s post about a CPP fraud scheme. Screenshot from a finance forum.

From phishing link to malicious download: The attack chain

The following screenshots show how the scammer sends a WhatsApp link to the phishing page, claiming it’s needed to cancel the Card Protection Plan. If a victim asks how to perform the cancellation, the scammer directs them to open the link and enter their details — a pretext to lure them onto the phishing page and harvest their information.

Figure 2: Examples of phishing messages with links to phishing pages

Interacting with any call-to-action button on the phishing page — such as “Login Now,” “Apply Now,” or “Activate Protection” — triggers an automatic, silent download of a malicious APK file hosted on a GitHub repository, without presenting the user with an explicit download prompt.

Distribution of APK files through Github accounts

Analysis of the identified phishing sites uncovered numerous GitHub-hosted repositories serving hundreds of malicious APKs, impersonating different financial institutions — a tactic that lends credibility to the payload and complicates takedown efforts.

Figure 4: Example of Github links on phishing website html page.

Figure 5: Example of GitHub repositories being abused to host malicious APK files.

Once installed on an Android device, the application employs a deceptive update mechanism; it displays what appears to be the app’s own Google Play Store update page, but instead of applying an update, it silently downloads and installs an entirely different application in the background. This technique deceives users into believing a routine update is taking place, when in fact a separate, unrelated app is being covertly installed on their device.

Figure 6: Example of fake Google Play update page.

The application also prompts the user to disable battery optimization, a request framed as necessary for normal functioning but actually intended to prevent the operating system’s background restrictions from terminating the malware, allowing it to continue running persistently in the background.

Figure 7. Additional permissions requested for persistence.

The purported process for deactivating the Card Protection Plan unfolds in four stages, each designed to progressively extract sensitive financial and personal data:

1. Initial Data Capture: Users are first prompted to enter their credit card number, expiry date, and CVV.
2. KYC Pretext: Framed as a mandatory Know Your Customer (KYC) verification step, the page then requests the user’s Net Banking (internet banking) login credentials and the grid numbers printed on the back of the card.
3. Identity Verification Stage: The flow redirects to a section requesting further personal identifiers, including the registered mobile number, PAN number, and date of birth.
4. Document Upload: In the final step, users are asked to upload a photograph of the front of their credit card, ostensibly to complete verification.

Each stage is designed to appear as a routine, incremental part of a legitimate deactivation process, while cumulatively harvesting all the data needed to fully compromise the victim’s card and identity.

Victimology & Impact

Group-IB analysts identified 2,364 unique victim devices, based on device UUIDs extracted from 2,805 “new app installation” notification messages. The discrepancy between total messages and unique devices reflects repeat installation events on the same device, likely resulting from re-installation, testing, or persistence attempts by the threat actor.

Figure 9. Monthly distribution of newly identified unique victims.

Our analysis also extended to another data exfiltration channel using Firebase storage. By examining this exposed Firebase infrastructure, we identified an additional 15,596 compromised devices, which raises the combined total of confirmed victims to 17,960 across both vectors.

Our analysis showed that a total of 7,611,443 messages were intercepted from victim devices over the course of the campaign. Intercepted messages included one-time passwords (OTPs), bank transaction notifications, and other sensitive account-related communications, forwarded from infected devices to the attacker-controlled Telegram bot infrastructure and firebase in near real time.

Additionally, messages were discovered containing compromised card data, such as card numbers, grid values, expiration dates, and CVV codes, alongside sensitive KYC information including full names, mobile numbers, dates of birth, PAN card details, and Aadhaar numbers.

Figure 10: Screenshots observed showing victim card details.

Case Studies:  Credit Card Protection Fraud cases in India

In multiple reported incidents, victims lost a cumulative total exceeding $30,500 after receiving fraudulent calls regarding credit card protection plans over this period.

Other examples are shown in the screenshots below from mainstream news media reporting, highlighting the prevalence of this scheme.

Other examples from Facebook and Reddit:

On popular social media platforms like Reddit and Facebook, numerous users came forward to recount strikingly similar scam experiences. The common social engineering tactics used included creating immediate pressure to act and leveraging sophisticated domain names to gain user trust. Attackers typically targeted victims within 24 hours of them receiving a new credit card.

Technical Analysis

Group-IB analysis of the APK files began with a sample exhibiting cryptocurrency mining functionality, known as d-miner, which drops an RAT during its execution. This raised the question of how to properly classify the resulting Trojans. At first, we assumed we were looking at the evolution of a single family, which we tracked as GhostBat. However, further research led us to another report describing an almost identical chain of behavior, publicly known as  GhostGrab. Our subsequent analysis revealed that GhostGrab is in fact an older version of GhostBat, and we therefore track them as a single family.

Shortly after, a fourth report surfaced, describing a similar chain involving a mining component paired with a RAT. In this case, however, d-miner was found distributing either BTMOB RAT or the SMS/Phone call stealer RAT. This led us to suspect that the d-miner dropper may in fact be used to distribute a variety of different Trojans, although we were unable to reach a definitive conclusion as to whether they all belong to the same threat actor.

This prompted us to take a closer look at each sample individually. All RAT identified within this cluster share the following capabilities:

• SMS interception and exfiltration
• SMS forwarding and sending
• Phone call forwarding
• Credit card data theft via phishing overlay

As previously noted, the victim installs a malicious APK containing a cryptocurrency mining component. The miner uses XMRig to exploit the device’s resources, relying on Firebase infrastructure for monitoring and control. It employs several persistence techniques to ensure continuous operation, including wake locks, a silent audio loop exploit, and a foreground service notification channel. The payload is downloaded from threat-actor-controlled infrastructure, encrypted using AES/CBC/PKCS5Padding, and connected to a dedicated mining pool upon execution.

More details on how d-miner operates can be found in the report by other vendors referenced above. Below you can find an overview of the full infection chain, from initial compromise through to the execution of all malware components.

Figure 13. d-miner infection chain.

Based on our analysis, we decided to classify the malware observed in this campaign into the following families:

• cyb3rx
• appkjl
• godz
• d-passive
• d-shine
• GhostBat (also known GhostGrab)
• tenxen

Rather than providing an in-depth technical analysis of each malware family we identified, we will instead walk through the reasoning behind treating them as separate families. It is worth noting, however, that during our research we discovered the development environment for GhostBat.

GhostBat developing environment

In 2024, developers of the GhostBat family shared screenshots in a Telegram chat, providing insight into their operational workflow. These images confirm that the threat actors utilized Android devices to both develop and compile their malicious payloads which differs from traditional malware development practices in desktop environments.

Figure 14. Shared screenshots from malware developer showing Android development environment.

The screenshots reveal several tools and file structures used in this process, including:

• AIDE – IDE for Android
• MT manager – APF file editor
• Acode – Code editor for android
• Apktool M – Android APK file editor
• Firebase app – most likely for Firebase c2 configuration
• A folder named AndroidIDEProjects and presence of .java files in the phone memory

Another interesting finding from our research was that one of the repositories used to distribute the cyb3rx’s malware contained an APK file responsible for managing infected devices.

Cyb3rx admin controller apk

During our investigation, we discovered a GitHub repository (ranidevisingh901-debug/gsafsdfsdf) containing an APK that functions as an administrative controller for the Cyb3rx malware family. Threat actors utilize this tool to monitor victim data and issue Command and Control (C2) instructions.

Figure 15. Cyb3rx admin controller apk.

The controller communicates via a hardcoded `api_base_url`, which are slightly different based on the phishing theme, for example, `hXXp://64.89[.]163.3/idfc/1/api/` or `hXXp://64.89[.]163.3/pnb/1/api/`. Its core administrative functionalities include:

• SMS Forwarding Management: Enables or disables global SMS forwarding by sending a JSON object containing an enable (boolean) and number (string) to api_base_url/update-config.php.
• Device Management: Allows operators to remove a device from the dashboard using its device_uuid via api_base_url/delete_device.php.
• Phishing Data Collection: Retrieves captured credit card information from phishing forms. The request targets get_device_data.php with parameters for device_uuid, data_type, and a record limit, using this form: api_base_url/get_device_data.php?device_uuid=[UUID]&data_type=[pm_kisan_details / idfc_banking_flow]&limit=50
• SMS & Notification Monitoring: Provides visibility into intercepted SMS messages and device notifications. The request is sent to “get_device_data.php” in this form:

api_base_url/get_device_data.php?device_uuid=[UUID]&data_type=[SMS / Notification]&limit=100

• C2 Command Execution: An interactive interface supports various commands, including call_forward_activate, call_forward_deactivate, set_sms_forwarding, send_sms, custom_ussd, and get_device_info. The request is sent to api_base_url/send_command_to_device.php with json object contains these keys: “device_uuid”, “command_type” and “command_data”

Family Identification

While these samples share the same packer, phishing themes, and RAT capabilities, they differ in their network communication, database structure, and Telegram messaging formats and show no direct connection to one another. Together, these differences confirmed our decision to treat them as distinct families.

There are 3 channels that are commonly used by families: Telegram, Firebase and Remote server. The main purpose of network communication are device check-ins, SMS exfiltration, command and control.

Device Check-In

When first launched, some families collect basic device information and register the infected device with the operator’s infrastructure. This allows the threat actor to identify and track active victims. As shown in the table below, families differ not only in which channel they use for registration, but also in what data they collect and how they format it — further evidence of independent development.

SMS Exfiltration

All families intercept incoming SMS messages and forward them to the operator. However, the channel used and the format of the exfiltrated data differ significantly between families. Some send messages to a Telegram bot, others post to a remote HTTP server, and others write directly to a Firebase database node. The structure of the data — field names, data types, and nesting — is inconsistent across families, which would be unlikely if they shared a single active development branch.

Command and Control

Each family supports its own distinct set of C2 commands delivered through its respective channel. The naming conventions, the number of supported commands, and their functionality all differ across families. For example, while most families support some form of call forwarding and SMS forwarding, the command names used to trigger these actions vary — suggesting each family was written independently rather than forked from a shared command handler.

Rationale for Malware Classification

Although we have classified the identified malware into seven distinct families, they are unified under the ‘CyberDakait’ threat cluster. We group these diverse families into a single cluster because they share a cohesive operational strategy:

• Unified Campaign Objectives: All families are employed in identical, coordinated financial fraud campaigns targeting Indian banks and government apps.
• Common Phishing Infrastructure: They leverage highly similar social engineering tactics, phishing domains, and GitHub-hosted distribution channels to deliver payloads.
• Shared Functionality: Each family features an overlapping core capability set, including XMRig-based cryptojacking and RAT modules for SMS and call interception, demonstrating a consistent intent to steal sensitive financial credentials.

While these shared behaviors confirm a common origin within the CyberDakait cluster, significant technical divergences in their C2 communication protocols, database schemas, and telemetry formatting indicate that they are likely separate projects or sub-projects. Treating them as unique families provides more granular intelligence, enabling defenders to create precise detection rules tailored to the specific network traffic and behavioral patterns of each individual strain.

Conclusion

CyberDakait represents a mature fraud cluster that has successfully established itself as a significant risk to India’s financial services sector. Their combination of technical sophistication, operational persistence, and market specialization makes them a high-priority threat requiring coordinated defensive measures. The group’s continuous operations, extensive infrastructure investment, and evolving malware capabilities demonstrate their commitment to long-term operations in the Indian financial sector.

Organizations in India’s banking and credit card industries should prioritize defense against Android-based threats, implement robust customer education programs about impersonation scams, and maintain heightened awareness of the specific tactics, techniques, and procedures employed by this persistent adversary.

The proliferation of malicious APKs is accelerating. Threat actors often pair convincing phishing infrastructure with trusted, legitimate platforms like GitHub to distribute payloads at scale.

Group-IB Threat Intelligence Team have reported all identified profiles and repositories linked to the CyberDakait cluster and phishing campaigns from this research to GitHub;  they have since been deactivated. If you come across similar accounts, we encourage you to report them as well — collective efforts are key to addressing such threats.

Recommendations

For End Users

• Never click links in unsolicited messages or download suspicious applications outside of official app stores.
• Verify all banking calls by hanging up and calling the official, verified customer care number listed on the bank’s website.
• Never share sensitive information like credit card details, CVV, or grid numbers on any website or application unless you initiated the transaction and trust the source.
• Carefully review the requested permissions when installing a new application, and be extremely cautious when an app requests Accessibility Service access or permission to read SMS messages.
• If you believe you have been defrauded, contact your bank to freeze immediately any bank accounts that your device has accessed.

Group-IB Fraud Matrix

Indicators of Compromise (IOCs)

Phishing domains:

APK files (SHA256):

C2-addresses:

Malicious Github accounts

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.