MalwarePublished 12 Dec 2025

RTO Challan Fraud: A Technical Report on APK-Based Financial and Identity Theft

Source AlienVault OTX General

Description

A sophisticated Android malware campaign distributes a malicious 'RTO Challan / e-Challan' APK via WhatsApp, targeting users with a fraudulent payment app. The malware employs advanced obfuscation and hidden installation techniques to maintain persistence and control over infected devices. It establishes a custom VPN tunnel to conceal network traffic and harvests extensive personal, device, and financial data. Key capabilities include OTP interception, call behavior manipulation, and presenting fake payment interfaces to steal banking credentials. The command-and-control infrastructure uses obfuscated Base64-encoded URLs linked to malicious domains. This campaign combines social engineering, mobile malware, and financial fraud, posing a significant risk of monetary loss and identity theft. Although no CVSS score is assigned, the threat severity is assessed as high due to the impact and exploitation ease. European organizations with Android users, especially those using WhatsApp and mobile banking, should be vigilant. Mitigation requires targeted user awareness, mobile security hygiene, and network monitoring for suspicious VPN tunnels and domain connections.

Impact

For European organizations, the impact of this threat is significant, particularly for entities with employees or customers using Android devices and WhatsApp for communication. The malware’s ability to intercept OTPs and steal banking credentials threatens the confidentiality and integrity of financial transactions, potentially leading to direct monetary losses and fraudulent activities. Identity theft risks are elevated due to extensive personal data harvesting, which can facilitate further social engineering attacks or fraud. The use of a custom VPN tunnel to mask network activity complicates detection and response efforts, increasing the likelihood of prolonged undetected compromise. Organizations involved in financial services, mobile payment platforms, or those with large mobile workforces are especially vulnerable. Additionally, the social engineering vector via WhatsApp exploits a widely used communication platform in Europe, increasing the attack surface. The threat could also affect supply chains and partners if infected devices are used to access corporate resources. Overall, the campaign undermines trust in mobile financial applications and can disrupt business operations through financial fraud and data breaches.

Defensive guidance

1. Implement targeted user awareness campaigns focusing on the risks of installing APKs from untrusted sources, especially those received via WhatsApp or other messaging apps. 2. Enforce strict mobile device management (MDM) policies that restrict installation of applications from unknown sources and require app vetting. 3. Deploy mobile security solutions capable of detecting obfuscated malware and monitoring for unusual VPN tunnel creation on devices. 4. Monitor network traffic for connections to known malicious domains such as jsonserv.biz and jsonserv.xyz, and block these at the network perimeter. 5. Encourage multi-factor authentication methods that do not rely solely on SMS OTPs, such as hardware tokens or authenticator apps, to mitigate OTP interception risks. 6. Regularly update and patch Android devices and applications to reduce vulnerabilities that malware could exploit. 7. Implement anomaly detection on call and SMS behavior to identify manipulation attempts. 8. Conduct incident response drills simulating mobile malware infections to improve readiness. 9. Collaborate with WhatsApp and mobile platform providers to report and take down malicious APK distribution channels. 10. Use threat intelligence feeds to stay updated on emerging indicators of compromise related to this campaign.

Summary

The 'RTO Challan Fraud' is a sophisticated Android malware campaign that propagates through WhatsApp by distributing a malicious APK masquerading as an official 'RTO Challan / e-Challan' payment application. The malware uses advanced code obfuscation and stealth installation methods to evade detection and establish persistent control over the victim's device. Once installed, it creates a custom VPN tunnel to mask its network communications, effectively hiding data exfiltration and command-and-control (C2) traffic from conventional monitoring tools. The malware harvests a wide array of sensitive information, including personal identifiers, device details, and financial data. It intercepts one-time passwords (OTPs) commonly used for two-factor authentication, manipulates call behavior to prevent victims from receiving security alerts, and presents fraudulent payment interfaces designed to trick users into entering banking credentials. The C2 infrastructure is sophisticated, employing obfuscated Base64-encoded URLs that resolve to malicious domains such as jsonserv.biz and jsonserv.xyz, complicating detection and takedown efforts. The campaign leverages social engineering tactics to convince users to install the APK, exploiting trust in WhatsApp communications and the familiarity of RTO/e-Challan services. This multi-faceted approach combining mobile malware, financial fraud, and identity theft poses a high-risk threat capable of causing severe financial losses and widespread exposure of sensitive personal data. Indicators of compromise include specific file hashes and malicious domains identified in the report. No known exploits in the wild or specific threat actors have been confirmed yet, but the campaign's sophistication and impact potential warrant urgent attention.

Indicators of compromise

Domains 2

jsonserv.biz
jsonserv.xyz

Hashes 7

0d299aea599b041ab6a532a778505bab
3c71ed035b9a89ea5b8617455951e5bb
8a7bc7b6c9f48e3955806575a745a73650cd5804
a4ffdde46f3c491f1d150ad3e0c4599836e08e79
22cf70a0dd866a4f5addd5d339fad3894a4ebb3e97d597fd7dac9b08899052fb
9209fc088cdcd7da0161cabf5b9384c2ca790214413ffb437452bcc865c58452
ef6b5dd1f17ec128cb1aac6de35142ddd0da358d

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Dec 2025, 13:08 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details

Indicators of compromise

Domains 2

Hashes 7

Community reviews

Related threats