New Android Threat in India Steals Banking Logins & Intercepts Your SMS OTPs: A CyberDudeBivash Threat Brief

From CyberDudeBivash Threat Intelligence · 30 Oct 2025 · cyberdudebivash.com

Your Employee’s Phone is Your New Biggest Vulnerability.

This malware targets personal devices, but what happens when that compromised phone connects to your corporate VPN? Your entire “Zero Trust” architecture is bypassed. CyberDudeBivash’s Mobile VAPT finds this gap before attackers do.Book an Emergency Mobile Threat Assessment & PenTest →

NEW ANDROID BANKING TROJAN • INDIA • OTP & LOGIN THEFT

Situation Brief: A new-generation Android banking trojan is actively targeting users in India. CyberDudeBivash Threat Intelligence has analyzed this threat, which uses a 2-stage attack to bypass 2-Factor Authentication (2FA). It uses a “Login Overlay” to steal your credentials and “SMS Interception” to steal your OTP, giving attackers full access to your bank account.

This is a decision-grade brief from CyberDudeBivash, built for two audiences. For Indian banking customers, this is an immediate 4-step action plan to secure your device. For CISOs and IT leaders, this is a critical warning: your corporate “Bring Your Own Device” (BYOD) policy is a wide-open gateway for a breach.

Executive Summary (TL;DR)

What It Is: A sophisticated Android malware (banking trojan) disguised as a “GST calculator,” “Aadhaar updater,” or “Cricket Scorer” app.
Attack 1 (Login Theft): It tricks you into granting “Accessibility Services” permission, which it uses to draw a fake, identical login screen over your real banking app (HDFC, ICICI, SBI, etc.). This is an “Overlay Attack.”
Attack 2 (OTP Theft): It tricks you into granting “Read SMS” permission. When your bank sends an OTP, the malware intercepts it, sends it to the attacker, and hides the notification from you.
B2C Action: Immediately go to Settings > Accessibility and Settings > Apps > Permissions. Revoke *any* non-system app that has these permissions. Install a mobile security suite NOW.
B2B Action: This malware turns your employee’s phone into a corporate spy. It bypasses your firewall via VPN and steals credentials. Your MDM policy is not enough. You need Mobile Threat Defense (MTD).
Our Recommendation: Book a Mobile VAPT to test your BYOD security.

Contents: Our Full Threat Analysis

Phase 1: FOR BANKING CUSTOMERS — The 2-Stage Heist (How It Works)

This banking trojan is successful because it doesn’t just “hack” your phone. It tricks *you* into giving it the keys. The infection is almost always from a “sideloaded” app (an `.apk` file) downloaded from a website or a link in an SMS/WhatsApp message, *not* the Google Play Store.

Stage 1: The Login Theft (The “Overlay Attack”)

This is the most critical part. The malware (disguised as a utility app) will ask you for a very dangerous permission: Accessibility Services.

The Lure: It will claim it needs this permission to “read your screen for you” or “perform automated tasks.”
The Power: Accessibility Services are Android’s most powerful feature. Granting it gives the app the ability to *see everything on your screen* and *perform any action as you*.
The Attack: The malware now waits. When it detects you have opened a legitimate banking app (like HDFC Bank, ICICI iMobile, YONO SBI, etc.), it instantly draws an invisible, fake login screen *over* the real app. It looks *identical*. You, thinking you’re on the real login page, type in your Customer ID and Password. The malware captures these credentials and sends them to the attacker.

Stage 2: The OTP Theft (The “SMS Interceptor”)

The attacker now has your login, but they are blocked by 2-Factor Authentication (2FA), right? Wrong. The app will *also* ask for another, more common permission: “Allow to read all SMS messages.”

The Lure: It will claim it needs this to “auto-fill OTPs” for your convenience.
The Attack: The attacker, now in possession of your login, triggers a transaction. Your bank sends you an SMS OTP. The malware, which is listening for all incoming SMS, instantly reads the 6-digit code.
The “Invisible” Theft: It immediately forwards this OTP to the attacker’s C2 (Command & Control) server. It then *hides the SMS notification* from you. You never even see the OTP arrive.

The heist is complete. The attacker has your login and your 2FA code. They can drain your account in seconds, and you won’t know until you get a “transaction successful” alert (which the malware may also try to hide).

Phase 2: Your Immediate 4-Step Protection Plan (How to Stop It)

This is a permissions-based attack. The good news is you can revoke these permissions *right now*.

Step 1: CRITICAL – Audit Your “Accessibility Services”

This is the master key. Go here immediately:

Go to Settings > Accessibility.
Find the menu for “Installed apps,” “Downloaded services,” or “Accessibility Menu.”
REVIEW THIS LIST. The *only* apps that should be here are trusted, known tools like official Password Managers (Bitwarden, 1Password) or system tools.
If you see *any* app you don’t recognize (like “QuickGST,” “Aadhaar Sync,” “CricketScorer,” or any game), TAP IT AND TURN IT OFF.

Step 2: Audit Your “SMS” Permissions

This is the second key. Go to Settings > Apps > Permission manager > SMS.

Review the list of apps “Allowed” to read your SMS.
Why does that “Photo Editor” or “Game” need to read your SMS? It doesn’t.
REVOKE the permission for any app that is not your primary messaging app (e.g., Google Messages) or a trusted system app.

Step 3: Stop Sideloading & Enable Google Play Protect

This malware almost exclusively spreads via `.apk` files from the internet. Stop downloading apps from websites or WhatsApp links. Stick to the Google Play Store. Also, ensure Play Protect is on (Open Play Store > Tap Profile > Play Protect > Settings (Cog) > Ensure “Scan apps with Play Protect” is ON).

Step 4: Install a Mobile Security Suite

Your phone needs an antivirus just like your PC. You need a tool that provides real-time malware detection and, just as importantly, anti-phishing protection to block the malicious websites these apps come from.

Recommended Tool: This is the exact threat Kaspersky Premium is built for. Its Android app provides real-time, automated malware scanning that finds these trojans *before* they can ask for permissions. It also blocks the phishing links used to spread them.
Get Kaspersky Premium (Affiliate Link) →

Phase 3: FOR BUSINESSES — Your BYOD Policy is a Critical Vulnerability

As a CISO, you may think this is a “consumer” problem. You are wrong. That compromised personal phone is now the biggest hole in your corporate security.

Your employee, now compromised, connects to your corporate network via the VPN or Outlook app. That malware is now inside your firewall.

A sophisticated mobile trojan with Accessibility Services can:

Read Corporate Credentials: It can perform the *same overlay attack* on your corporate password manager, your SSO login (Okta, Azure AD), or your Outlook/Gmail app.
Scan Your Internal Network: Once on the VPN, the malware can act as a beachhead, scanning your internal-only IP addresses and services.
Intercept Corporate 2FA: Does your company still use SMS for 2FA? This malware just bypassed it.
Steal Sensitive Data: Accessibility Services can read *everything*. This includes confidential emails, Teams/Slack chats, and data from your internal CRM or ERP apps.

Your Mobile Device Management (MDM) solution is not designed to stop this. An MDM enforces *policy* (e.g., “device must have a PIN”). It is not a Mobile Threat Defense (MTD) or Mobile EDR solution. It has no visibility into this in-memory, permissions-based attack.

How We Detect This: Shifting to Mobile EDR & Behavioral AI

You cannot fight this fileless attack with file-based scanners. You must pivot to behavioral-based threat hunting, even on mobile. This is the core of our CyberDudeBivash Managed Detection & Response (MDR) philosophy.

Our SecOps team, using a Mobile EDR, doesn’t just look for “bad files.” We hunt for “bad behaviors” and ask the right questions:

Question 1: “Why did a ‘GST Calculator’ app just request Accessibility Services?” (High-Fidelity Alert)
Question 2: “Why is that same app *also* requesting `READ_SMS` permission?” (Critical-Fidelity Alert)
Question 3: “Why is a ‘Game’ app drawing an overlay on top of the ‘ICICI iMobile’ app package?” (Breach-in-Progress Alert)
Question 4: “Why is this mobile device, connected to our VPN, suddenly performing an Nmap-like scan of our internal subnet?” (Containment Protocol Initiated)

This is the future of endpoint security. Your “endpoint” is no longer just a laptop. It’s the phone in your employee’s pocket.

Automate Your Mobile Defense: This is why we built our proprietary app suite. Our PhishRadar AI blocks the initial SMS/WhatsApp phishing link, and SessionShield is designed to protect the corporate app session *even if* credentials and an OTP are compromised, by analyzing user behavior.
Explore SessionShield by CyberDudeBivash →

Our Vetted Security Toolkit (Mobile Defense)

As a global cybersecurity firm, we only recommend tools that can survive our own Red Team. Here is the toolkit for this playbook (includes partner links):

Kaspersky Premium (Android)For You (B2C): The best-in-class real-time malware scanner and web phishing filter for your personal Android phone.Get Total Protection →Edureka — CyberSec CoursesFor Business (B2B): Train your IT/SecOps team on Mobile Security, MDM, and MTD policies.Upskill Your SecOps Team →

TurboVPNThe infection can come from public Wi-Fi (Man-in-the-Middle). A VPN is your first line of defense.Secure Your Mobile Connection →RewardfulIf you’re a developer, create a “bug bounty” program to find these flaws. We use Rewardful for our own apps.Launch Your Partner Program →

About CyberDudeBivash: Your Response Partner

CyberDudeBivash is a Global Cybersecurity Apps, Services & Threat Intelligence Firm.

We don’t just write guides about mobile malware; we hunt it. Our Red Team and Incident Response services are built for the reality of a BYOD world. We find the blind spots in your mobile, web, and cloud infrastructure *before* attackers do.

“[Your Best Client Testimonial Here. e.g., ‘CyberDudeBivash’s Mobile VAPT found a critical authentication bypass in our internal app that our MDM completely missed. They showed us how an un-patched employee phone could have led to a full corporate data breach.’]”
– CISO, [Client Company / Industry]

Our Core Mobile Security Services:

Mobile VAPT (Penetration Testing): Our core service. We simulate this *exact* attack to see if your BYOD policy and MTD/MDM solutions are secure.
Managed Detection & Response (MDR): Our 24/7 SecOps team becomes your behavioral threat hunters, monitoring your mobile fleet for these “permission abuse” attacks.
Emergency Incident Response (IR): If you suspect a mobile-based breach, our digital forensics team can trace the attack and eradicate it.
PhishRadar AI & SessionShield: Our proprietary apps to protect the user’s browser and corporate sessions from these advanced threats.

Book Your Mobile VAPT Engagement →Explore Our Apps & MDR Services

FAQ: Android Banking Malware

Q: I checked my permissions and they are clean. Am I safe?
A: You are safer, but not 100% safe. This is just one known variant. The best defense is layered: 1) Clean permissions. 2) Only use the Play Store. 3) Run a real-time security suite like Kaspersky. 4) Be suspicious of *all* unsolicited links.

Q: I think I’m infected! What do I do RIGHT NOW?
A: 1. Put your phone in Airplane Mode to cut the attacker’s connection. 2. Call your bank(s) *from a different, trusted device* and tell them to freeze your accounts. 3. Boot your phone into Safe Mode (this disables third-party apps). 4. In Safe Mode, go to Settings > Apps and uninstall the suspicious app. 5. Reboot your phone normally and run a full malware scan.

Q: My company uses an MDM. Aren’t we protected?
A: No. MDM (Mobile Device Management) is a *policy* tool (it enforces PINs, blocks cameras). It is *not* an MTD (Mobile Threat Defense) solution. An MDM has no visibility into an app abusing Accessibility Services. You must supplement your MDM with an MTD/MEDR solution and test it with a Mobile VAPT from our team.

Q: Is iPhone safer than Android?
A: Yes, in this specific scenario. Apple’s iOS does not have an “Accessibility Service” with this level of power, and it does not allow “sideloading” of apps. This makes overlay and permission-based attacks much harder to execute on an iPhone. However, iPhones are still vulnerable to other attacks like phishing and zero-days.

Next Reads from CyberDudeBivash

Disclosure: We are a CyberDudeBivash Brand. This post includes affiliate links to tools we personally use and trust for cybersecurity services. We may earn a commission from purchases at no extra cost to you. Our opinions are independent and based on expert-led penetration testing and incident response engagements.

CyberDudeBivash — Global Cybersecurity Apps, Services & Threat Intelligence.

Official Site · Threat Intel Blog · Crypto Research · LinkedIn

#AndroidMalware #BankingTrojan #India #OTPTheft #OverlayAttack #Cybersecurity #MobileSecurity #CyberDudeBivash #Phishing #VAPT #MDM #BYOD #IncidentResponse #2FA

Cyberdudebivash