The MR ROBOT malware service rents customized fake Android banking apps to criminals targeting Indian bank customers. Victims are lured through fake Play Store-style pages and links in messaging apps, then tricked into installing apps that can steal banking details, intercept one-time passwords, and redirect bank verification calls.
MR ROBOT is a malware-as-a-service platform that gives affiliates the ability to generate customized Android apps impersonating specific Indian banks. Each affiliate receives its own application ID, allowing the operation to scale across many fake bank apps at once. Victims are reached through fake Play Store-style pages and links shared in messaging apps, with lures that go beyond banking to include utility bills, telecom services, traffic fines, and government services. One storefront, a Telegram bot called APK Shield, offered around 36 different lure apps covering these categories.
Once installed, the malware shows fake screens designed to harvest banking credentials, card details, PINs, and identity information. It also intercepts text messages carrying one-time passwords, giving attackers the ability to bypass OTP-based verification. In addition, the malware can silently enable call forwarding, which can redirect a bank's fraud-check callback to a number the attackers control instead of the legitimate customer.
The lures worked because they mimicked something people expect to see and trust: an app update notice, a utility bill, or a government notice arriving through a familiar channel like text or WhatsApp. The fake Play Store-style download pages added a layer of visual legitimacy without requiring victims to use the real app store at all. By expanding beyond banks into utilities, telecom, traffic fines, and government services, the operation increased the number of plausible scenarios where a target might expect an app-installation prompt.
Organizations and individuals can reduce exposure by reinforcing a few consistent habits. Banking, utility, and government apps should only be installed from the official app store or a verified organizational website, never from a link sent through a messaging app. Any unexpected app-installation request tied to a bill, fine, or notice deserves scrutiny before anything is downloaded. Credentials, card details, PINs, and OTPs should never be entered into an app obtained from an unverified link. Finally, if a bank's fraud or verification call seems unusual or fails to reach a customer as expected, the safest response is to call the bank back using a trusted number from its official website or the back of a card rather than relying on an inbound call.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
MR ROBOT is a malware-as-a-service platform that lets affiliates generate Android apps impersonating specific Indian banks, which are then used to steal banking details and intercept one-time passwords.
Victims are lured through fake Play Store-style pages and links sent via messaging apps, with lures impersonating banks, utility providers, telecom services, traffic fines, and government services.
It can capture banking credentials, card information, PINs, and identity details, intercept text-message one-time passwords, and silently enable call forwarding to redirect bank fraud-check calls.
Install banking, utility, and government apps only from the official app store or a verified website, and never install an app sent through a text message, WhatsApp, or Telegram link.
“Your bank mobile app needs updating.” Got that text? The link opens a page that looks like Google Play, but isn’t. Install its bank-branded app, and MR ROBOT can grab your login, PIN, and text-message OTPs. Here’s the twist: it can also forward your bank’s fraud-check call away from you. The giveaway? An “app update” delivered by text, WhatsApp, or Telegram. Need the app? Skip the message link. Open your phone’s official app store and find it there.
Researchers described an Android Trojan (“RatHat”) that starts with scam texts or malicious ads and tricks people into installing a fake app from a bogus download page. After installation, it pressures victims to grant Accessibility permissions using fake excuses or incentives, then uses those…
A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
A financially motivated campaign in India used fake bank calls and WhatsApp links to persuade recent credit-card recipients to install malicious Android apps. The apps stole banking details and text messages, including one-time passwords, allowing criminals to support fraudulent transactions.
Researchers linked the uCreator Android spyware kit to real campaigns that used ads and fake app-store sites to distribute tampered Telegram X apps. The sites marketed Telegram X as a dating and video-chat app, persuading victims to sideload it; once installed, the altered app could steal Telegram…
A weekly threat roundup includes multiple real-world social engineering campaigns, including a phishing operation that abuses legitimate Power BI domains to look trustworthy and trick users into downloading a remote-access tool installer. It also describes a WhatsApp-delivered lure that tricks…
