A financially motivated campaign in India used fake bank calls and WhatsApp links to persuade recent credit-card recipients to install malicious Android apps. The apps stole banking details and text messages, including one-time passwords, allowing criminals to support fraudulent transactions.
The campaign, tied to a cluster tracked as CyberDakait, targeted Indian financial-services customers starting at least in July 2025. Victims received a phone call shortly after getting a new credit card. The caller, posing as a bank employee, claimed that a 'Credit Card Protection Plan' had been activated on the account and would generate unwanted charges unless cancelled. To resolve the issue, the victim was sent a link through WhatsApp.
That link led to a bank-themed phishing page that instructed the victim to install an Android application rather than use an official app store. The APK files were hosted on GitHub repositories. Once installed, the app displayed a fake Google Play update screen while quietly installing a second application that carried out the actual data theft.
Several factors made this pretext convincing:
The operation impersonated 11 Indian banking institutions and two government programs, and it compromised at least 17,960 Android devices, intercepting over 7.6 million SMS messages, including one-time passwords, card information, PAN details, and Aadhaar numbers.
Employees who use Android devices, especially those with corporate or personal credit cards, finance and procurement staff, and customer-facing banking staff should be trained to independently verify any bank call using the number on the card or the bank's official app rather than acting on a link sent through WhatsApp. Any request to install an APK from a webpage, rather than an app store, should be treated as a red flag. Users should also be cautious about approving unusual device permissions, such as disabling battery optimization, simply because an app requests it. Because a compromised phone can leak one-time passwords and transaction alerts without any further action from the victim, protecting the device itself is as important as protecting login credentials.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A caller posing as a bank employee told recent credit-card recipients that a 'Credit Card Protection Plan' had been activated and would generate charges unless cancelled, then sent a WhatsApp link to complete the fake cancellation.
Bank-themed phishing pages directed visitors to download malicious Android APK files hosted in GitHub repositories, which displayed a fake Google Play update page while installing additional malware.
The malware intercepted SMS messages, including one-time passwords, transaction alerts, card information, PAN details, and Aadhaar numbers, forwarding them to attacker-controlled systems.
The malicious app requested that battery optimization be disabled so it could remain active in the background despite Android's restrictions on background apps.
Just got a credit card? A caller says a Protection Plan will start charging you. They send a WhatsApp cancellation link. The bank-looking page says install an Android APK, but the download comes from GitHub, not your bank. Here's the trap: the app shows a fake Google Play update and asks to disable battery optimization. It can then read your texts, including bank one-time passwords. Unexpected plan charge? Ignore the WhatsApp link. Call the number printed on your card.
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
