Security researchers at CloudSEK disclosed on 28 October a previously unreported malware operation they call MR ROBOT. It works as malware-as-a-service: criminals rent ready-made tools to build fake banking apps and spread them to victims.
How it works
- Victims receive a link through a messaging app, or land on a counterfeit download page that looks like a bank's.
- They install an APK file that imitates a real banking app.
- Once installed, the app can steal banking login details, read SMS and OTPs, and change call forwarding so bank verification calls go to the criminals.
In one affiliate's data alone, researchers found 153 infected devices and 5,407 intercepted SMS messages. That's a snapshot from one dataset, not a national total, but it shows how quickly OTPs can be harvested.
Red flags
- Any bank, "KYC update", reward point or bill-payment app sent as a file or link on WhatsApp or SMS.
- An app asking for SMS access, Accessibility access or to be a "default SMS app".
- Your phone suddenly showing call forwarding active (an icon or a message from your operator).
How to protect yourself
- Install banking apps only from the Google Play Store, and check the developer name matches your bank.
- Keep Install unknown apps turned off for WhatsApp, browsers and file managers (Settings → Apps → Special app access).
- Keep Google Play Protect on.
- Check call forwarding: dial *#21# to see whether forwarding is active, and ##002# to cancel all forwarding.
If you installed a suspicious app
- Turn on flight mode immediately.
- Call your bank from another phone to block net banking, cards and UPI.
- Uninstall the app (boot into safe mode if it refuses).
- Report at cybercrime.gov.in or call 1930, especially if money has moved.
- Change your banking and email passwords from a clean device.
Sources: The420.in
