Security1 hOctober 28, 2026, 13:17

CloudSEK finds Mr Robot gang renting Android malware to target Indian bank customers

CloudSEK has uncovered a gang called Mr Robot that rents out a crimeware platform used to install malicious apps on Indian banking customers' phones. The malware hides its icon, steals SMS OTPs and forwards bank calls to fraudsters via the *21# code. Its catalogue holds about 36 lure apps, including fakes for nine banks and RTO fine pages.

Mint

Open source

CloudSEK finds Mr Robot gang renting Android malware to target Indian bank customers

Malware stays dormant for 48 hours and uses a new signature per copy
One affiliate had 153 infected phones and 5,407 intercepted SMS
Call forwarding was active on 58% of victims
Catalogue lists about 36 lure apps

#CloudSEK#Android

Banking Trojans Now Make Up 56.4% of Android Malware

Security

RemControl Android banking malware targets Europe and Canada

Security

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Security

CloudSEK finds Mr Robot gang renting Android malware to target Indian bank customers

Banking Trojans Now Make Up 56.4% of Android Malware

RemControl Android banking malware targets Europe and Canada

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Nippon Columbia malware incident exposes 8.7 million karaoke customer records