Breaches and incidents
FatBoyPanel Android banking malware (India): 222 open Firebase buckets held stolen bank SMS of about 50,000 victims
Zimperium reported on 4 Feb 2025 almost 900 samples (over 1,000 apps analysed) spread through WhatsApp as APKs posing as government or bank apps.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Zimperium reported on 4 Feb 2025 almost 900 samples (over 1,000 apps analysed) spread through WhatsApp as APKs posing as government or bank apps. Over 222 publicly accessible Firebase storage buckets held 2.5 GB, mostly SMS from Indian banks, plus bank, card and ID details; about 50,000 users affected.
- Root cause: victims sideloaded apps that read SMS and forward OTPs to attacker phone numbers or Firebase endpoints acting as command-and-control; the operators’ own buckets were left open.
- Attacker: operators of the “FatBoyPanel” campaign, not identified; Zimperium found about 1,000 linked phone numbers.
- Response: Zimperium says it will share the numbers with authorities on request; no CERT-In action located.