False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps

Since July 2025, a financially motivated threat actor named CyberDakait has conducted a sophisticated Android malware campaign targeting India's financial services sector. The campaign uses seven distinct Android trojan families distributed via smishing and vishing, impersonating bank representatives to trick victims into installing malicious APKs. These trojans steal banking credentials, credit card details, and intercept SMS messages including OTPs through overlay attacks. Additionally, the malware performs cryptojacking using XMRig. The malicious apps are hosted on GitHub to appear legitimate, with initial droppers delivering the main payload and mining modules. At least 17,960 devices have been compromised with 7.6 million intercepted SMS messages reported.

• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14
• SkyW4lker Phishing Kit: Microsoft 365 Threat to US FirmsMalware2026-10-27
• Automated Subversion and Attempted Takeover of AI Pentesting HarnessesMalware2026-10-27
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27