Inside "MR ROBOT" - Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank Customers
Source AlienVault OTX General
Description
A sophisticated Android Malware-as-a-Service operation called MR ROBOT is actively targeting Indian bank customers through a subscription-based model. The platform enables cybercriminals to rent customized banking trojans distributed via fake Play Store pages and messaging apps. The operation uses a multi-stage dropper that decrypts encrypted payloads to deploy banking trojans capable of intercepting SMS and OTPs, silently enabling call forwarding using the *21# carrier code to bypass phone-based two-factor authentication, and overlaying phishing screens to harvest card details, CVV, ATM PINs, UPI credentials, and identity documents. One tracked affiliate compromised 153 devices and intercepted 5,407 SMS messages across multiple Indian banks. The operation features a Telegram bot storefront offering approximately 36 fake applications impersonating banks, utility providers, and government services, with stolen data exfiltrated to Firebase Realtime Database and Telegram channels.