Breaches and incidents
MR ROBOT malware-as-a-service (India): rented banking trojans steal OTPs and forward bank callbacks from Indian bank customers
CloudSEK describes MR ROBOT as a multi-tenant Android crimeware platform.
- Disclosed
- Verification
- Checked against a primary source
What happened
- CloudSEK describes MR ROBOT as a multi-tenant Android crimeware platform: a web control panel (v7.0), a Telegram storefront and dropper brand called “APK Shield”, and a builder that produces bank-themed trojans per affiliate. The catalogue offers about 36 lure apps (banks, utilities, RTO traffic fines). One affiliate’s panel showed about 154 enrolled devices and about 3,270 intercepted messages; a second affiliate’s exposed Firebase database showed 153 devices and 5,407 intercepted SMS captured 16 to 30 Jul 2026.
- Technique: bank-branded APKs pushed by SMS, WhatsApp and Telegram links and fake Play Store pages; SMS OTP interception, fake credential/card/PIN screens, silent *21# call forwarding (active on 58% of the second affiliate’s victims, so banks’ fraud-check calls go to the attacker), launcher hiding, a new signing certificate per build.
- Attacker: unnamed affiliates of the MR ROBOT operation; CloudSEK places it in a cluster with Zimperium’s FatBoyPanel and RedWing (shared call forwarding and per-customer builders) but says shared lineage is not established.
- Response: CloudSEK advises banks to move customers from SMS OTP to app-based or FIDO authentication; no law-enforcement action reported.