Group-IB has detailed an ongoing Android malware campaign, run by a money-driven group it tracks as
CyberDakait, that has targeted customers of Indian banks since July 2025. Attackers phone or text
people posing as their bank, warn that a Credit Card Protection Plan will be charged unless it is
cancelled, and steer them to a fake page that quietly installs a malicious app. The app steals card
details, net-banking logins, OTPs and identity documents, forwards the victim’s text messages and
calls, and secretly mines cryptocurrency on the phone. At least 17,960 devices have been
compromised and 7.6 million text messages intercepted. Banks should warn customers now and watch
for the attacker’s phishing sites and infrastructure.
1. Campaign Timeline
Group-IB attributes the campaign to a financially-motivated cluster it tracks as CyberDakait, active against India’s
financial sector since July 2025, with victim reports dating to January 2025. It uses seven trojan families (cyb3rx, appkjl,
godz, d-passive, d-shine, GhostBat and tenxen) delivered through a shared d-miner dropper, and impersonates 11 Indian
banks and 2 government programs. Group-IB confirmed at least 17,960 compromised devices and 7.6 million intercepted
SMS messages, including OTPs and transaction alerts, with cited victim losses exceeding 30,500 US dollars. No specific
named threat group has been formally attributed.
2. Attack Details
- Initial Access
Victims receive smishing or vishing messages impersonating a bank representative about a Credit Card Protection Plan, with charges of roughly 5 to 150 US dollars unless it is deactivated at once. A WhatsApp or SMS link leads to a bank-themed phishing page, often hosted on GitHub Pages. - Delivery and Install
Clicking any button on the phishing page silently downloads a malicious APK from a GitHub repository with no download prompt. The app shows a fake Google Play update screen while installing a different payload in the background, and asks the user to disable battery optimisation so it survives in the background. - Data Harvesting
A four-stage flow collects card number, expiry and CVV, then net-banking credentials and the grid values from the card back, then registered mobile number, PAN and date of birth, and finally a photo of the card, each framed as a routine deactivation or KYC step. - Exfiltration and C2
The malware intercepts and forwards incoming SMS, including OTPs, and forwards calls, sending data to attacker infrastructure over Telegram bots, Firebase and remote servers. A Cyb3rx admin controller APK lets operators track victims and issue commands such as SMS forwarding, call forwarding, custom USSD and send SMS.
3. Payload Capabilities
- Credential and card theft: Phishing overlays and forms harvest card number, expiry, CVV, grid values, net-banking credentials, PAN, Aadhaar, date of birth and a card photo, giving the operator everything needed to take over the card and identity.
- SMS and call interception: All families intercept, forward and send SMS and forward phone calls, capturing OTPs and transaction alerts in near real time so the operator can authorise fraudulent transactions from the victim’s own number.
- Cryptojacking: The d-miner component runs XMRig to mine Monero on the device, with its payload AES-encrypted and fetched from attacker infrastructure, and persists through wake locks, a silent audio loop and a foreground service, draining the device while fraud proceeds.
- Admin controller: A dedicated controller APK (found in a GitHub repo) manages infected devices through a hardcoded api_base_url, enabling global SMS forwarding, device removal, phishing-data retrieval and interactive C2
4. Adversary Toolkit
| TOOL / INDICATOR | TYPE | FUNCTION |
| d-miner | Android dropper + XMRig miner | Drops the RAT payload and runs Monero mining; uses Firebase for monitoring. |
| GhostBat (aka GhostGrab) | Android banking RAT | SMS and call interception and card theft via phishing overlay; developed on Android devices. |
| cyb3rx | Android banking RAT (remote server C2) | SMS exfiltration and C2 via remote server; paired with an admin controller APK. |
| godz, d-passive, d-shine, tenxen, appkjl | Android banking RATs | Distinct families with separate Firebase, Telegram, or remote-server C2 and overlapping SMS, call, and card-theft capability. |
| Cyb3rx admin controller APK | Operator tooling | Tracks victims and issues C2 commands via a hardcoded api_base_url |
5. Indicators of Compromise (IOCs)
https://www.virustotal.com/gui/collection/fd4da2f6ecedad40819bdf2749417c7a4e7cca9570ca20a74094931cece3c718/iocs
6. Recommendations
- Run customer awareness on this scam: a bank never asks a customer to install an app or share card number, CVV, grid values, PAN, Aadhaar or OTP to deactivate a Card Protection Plan; tell customers to hang up and call the number printed on the card.
- Monitor for brand-impersonation phishing domains and GitHub repositories hosting fake banking APKs, and request takedowns; GitHub Pages subdomains and lookalike domains are active distribution channels for this campaign.
- For managed or corporate devices, use mobile threat defence or MDM to block sideloaded APKs and flag apps that request Accessibility Service or SMS-read permission, seek battery-optimisation exemptions, or run XMRig mining.
- If a customer or device is suspected compromised, freeze the affected accounts, reset net-bankingcredentials, reissue the card, remove the app, and treat any intercepted OTPs as burned.
- Monitor for the IOCs. Block the IOCs at their respective controls, https://www.virustotal.com/gui/collection/fd4da2f6ecedad40819bdf2749417c7a4e7cca9570ca20a74094931cece3c718/iocs
Sources
https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.