Rising Threat: New Android Malware Service Targets Indian Bank Customers
A recent threat has emerged in the landscape of cybercrime, as a sophisticated Android malware-as-a-service (MaaS) operation has been identified. Dubbed MR ROBOT, this operation specializes in renting customized banking trojans aimed at deceiving Indian bank customers. According to detailed research published by the threat intelligence firm CloudSEK on October 28, the operation has already proven effective, with one affiliate reportedly intercepting a staggering 5,407 text messages from 153 infected devices.
An Overview of MR ROBOT
The MR ROBOT operation is not a singular endeavor but rather a multi-tenant crimeware platform, putting a professional facade on cybercriminal activities. Rather than relying on a single actor, the platform allows multiple affiliates to spread their nefarious activities. Each affiliate is allocated a unique application ID, enabling them to generate Android packages that impersonate specific Indian banks. This layered structure allows various criminals to participate in the operation, making it difficult for authorities to pinpoint responsibility.
The malware’s distribution is problematic. It employs tactics involving fake Play Store-style pages and links sent via messaging apps, such as WhatsApp and Telegram. These lures mimic legitimate banking applications as well as services provided by utility companies and government entities, heightening the chance of unsuspecting individuals falling victim to the scam.
Introducing a Subscription Model for Cybercrime
CloudSEK’s research elaborates that MR ROBOT operates under a tiered reseller model with sub-admin accounts. This allows affiliates not only to access the platform for a fee but also to manage their operations through a user-friendly control panel, identified as version 7.0. The malware itself is highly versatile: it intercepts text messages containing one-time passwords (OTPs), displays counterfeit screens to collect sensitive banking credentials, card details, PINs, and personal identification information. Notably, it can also silently enable call forwarding, effectively rerouting incoming bank-related calls—like fraud-check callbacks—to numbers controlled by the attackers.
The malware storefront operates through a Telegram bot called APK Shield, where approximately 36 different lure applications are offered. The array includes apps that impersonate banks and create fraudulent versions of utility bill applications, telecom services, traffic fines, and even government services. This broad spectrum of fake applications significantly increases the potential victims, allowing the criminals to cast a wider net.
Eyewitness Account: Tracking Affiliate Activities
CloudSEK has been closely monitoring activities on the MR ROBOT platform, especially focusing on two specific affiliates. One affiliate’s control panel, which managed around 154 enrolled devices, recorded approximately 3,270 intercepted messages. On the other hand, a separate and exposed Firebase database linked to another affiliate contained 153 devices and an astonishing 5,407 intercepted messages. The data in question was collected over a two-week span from July 16 to July 30, 2026, with nearly 4,000 messages originating from well-known bank and telecommunications short codes.
Alarmingly, 58% of the devices under investigation had call forwarding functionality activated. Each malware build is designed to receive unique signing certificates upon installation, making it harder for users to recognize that their devices are compromised. Moreover, MR ROBOT has shown technical sophistication, sharing call forwarding capabilities and customer-specific builders with other documented operations such as FatBoyPanel and RedWing. However, the unique elements of its kit, storefront, and control panel had not been previously reported, making this operation particularly alarming.
The Call to Action
Given the rising threat posed by MR ROBOT and similar operations, CloudSEK has strongly advised users to be vigilant. Individuals are urged never to install banking applications from links sent to them via text messages, WhatsApp, or Telegram. Instead, customers are encouraged to rely on official websites and apps. Additionally, the firm has called upon banks to transition their customer authentication methods away from text-message OTPs toward more secure options such as app-based authentication or Fast Identity Online (FIDO) solutions when feasible.
In conclusion, the continuous evolution of malware services such as MR ROBOT underscores the necessity for heightened awareness and improved security measures among both users and financial institutions. The growing sophistication of these operations indicates that proactive measures must be promptly implemented to safeguard against escalating threats in the digital landscape.