MR ROBOT malware network targets bank customers across India

A subscription-based Android malware operation is targeting bank customers across India, allowing criminals to create fraudulent applications that intercept security codes, steal financial credentials and divert verification calls.

Cybersecurity company CloudSEK identified the operation, named MR ROBOT, in an investigation published on 28 October. Its findings show that one affiliate controlled 153 compromised devices and intercepted 5,407 text messages, offering a documented glimpse of how the criminal service operates.

The exposed database contained messages collected between 16 and 30 July 2026. Approximately 4,000 originated from banking and telecommunications short codes, including communications associated with one-time passwords. Researchers found call forwarding enabled on 58 per cent of the affected devices, potentially redirecting banks’ verification calls to numbers controlled by criminals.

CloudSEK separately examined another affiliate whose management panel recorded approximately 154 enrolled devices and 3,270 intercepted messages. Those figures represent observations from two affiliates, rather than a confirmed total for the wider network. Neither the overall number of victims nor the financial losses attributable to MR ROBOT has been established.

The investigation was based partly on management software and an exposed database, rather than access to the entire criminal network. Researchers identified an operator console and a web control panel that exposed functions for monitoring infected devices, retrieving messages and managing call forwarding. The platform operates through a rental model in which customers obtain individual application identifiers and access a management dashboard. They can select a bank, generate a customised malicious Android installation package and distribute it under the appearance of a legitimate financial application. Administrative features also permit subordinate accounts, indicating that affiliates can resell access.

A Telegram-based storefront associated with the operation offered approximately 36 deceptive applications. The catalogue included impersonations of nine banks, alongside utilities, telecommunications services and government-related payment facilities. Fraudulent traffic-fine pages requesting payments of ₹9 or ₹10 were also designed to collect personal information.

Potential victims are directed towards counterfeit application pages or installation links distributed through messaging services. Some applications impersonate Aadhaar updates or know-your-customer verification procedures, using familiar administrative requests to persuade customers to install software outside official application stores.

Once installed, the trojan can capture incoming text messages, display counterfeit forms and extract Aadhaar and PAN information, payment-card numbers, security codes, ATM PINs, UPI PINs and online banking credentials. The capability to intercept authentication messages creates particular risks where financial services still depend on texted one-time passwords.

Its call-diversion function adds another layer to the attack. By activating unconditional forwarding through a mobile network command, the malware can route incoming calls away from the account holder. That could interfere with a bank’s attempt to confirm suspicious account activity directly with its customer.

CloudSEK also identified mechanisms intended to frustrate security checks. Certain builds delay malicious activity for at least 48 hours and require multiple launches before activating. Others conceal their application icons, check for analysis environments and employ separately generated signing certificates, reducing the usefulness of simple signature-based detection.

The malware uses encrypted components and can transmit stolen information to Firebase databases associated with individual affiliates. Researchers identified Cloudflare-hosted management infrastructure and temporary network tunnels that can obscure the underlying server. The presence of separate databases means disrupting one affiliate’s collection point would not necessarily disable every participant.

CloudSEK said the bank-specific applications examined under one affiliate used the same underlying Firebase configuration, allowing multiple deceptive brands to send stolen information into a common collection point. This arrangement could give investigators a means of disrupting several fraudulent applications.

The second affiliate’s exposed records showed that 149 of its 153 devices had been enrolled during a concentrated period in May. The recorded handsets covered eight manufacturers, predominantly lower-cost Android models, and connections across India’s four major mobile network operators. The busiest recorded interception day was 25 July, when 562 messages were captured.

Researchers also found evidence that some configurations could retrieve photographs and inventories of installed applications, suggesting surveillance capabilities extending beyond banking messages. The operation shares techniques with other Android banking threats, including FatBoyPanel and RedWing, but CloudSEK did not establish that the same operators controlled them.

CloudSEK recommended action against the distribution channels and data-collection infrastructure, alongside stronger customer authentication that does not depend solely on text messages. It advised customers to avoid installing banking or identity-verification applications supplied through unsolicited messaging links and to examine unexpected call-forwarding settings.