Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Android Banking Trojans Compromise Nearly 18,000 Phones and Siphon 7.6 Million SMS Messages in India

A financially motivated Android malware cluster tracked as CyberDakait compromised at least 17,960 phones in India, impersonated 11 banks and forwarded more than 7.6 million SMS messages, including one-time passcodes, to attacker-controlled Telegram bots.

4T4Tify Team4Tify
Oct 29, 2026·6 min read
Android Banking Trojans Compromise Nearly 18,000 Phones and Siphon 7.6 Million SMS Messages in India

Android Banking Trojans Compromise Nearly 18,000 Phones and Siphon 7.6 Million SMS Messages in India

A coordinated Android malware campaign aimed at banking customers in India has compromised at least 17,960 devices and intercepted more than 7.6 million text messages, including one-time passcodes and transaction alerts. The activity is tracked as a financially motivated cluster dubbed CyberDakait, which blends social-engineering phone calls, bank-themed phishing sites, trojanised apps and even cryptocurrency mining on the victim's handset.

What happened

The operators impersonated 11 Indian banks and two government programmes. The scheme usually starts with a phone call: someone claiming to work for the victim's bank warns that a "credit card protection plan" has been activated and will start generating charges unless it is cancelled right away. The caller then sends a link, often over WhatsApp, that supposedly leads to the cancellation form.

The link opens a phishing page styled after the bank, which pushes an Android APK hosted in public GitHub repositories. Once installed, the app shows a fake Google Play update screen and quietly drops a second payload. It asks the user to exempt it from battery optimisation so it can keep running in the background, then walks the victim through a staged "cancellation" that collects card numbers, expiry dates and CVVs, internet-banking credentials, national ID numbers and even photographs. Each request looks like one more verification step, which is exactly what makes the flow convincing.

Behind the scenes, the malware forwards every incoming SMS to attacker-controlled Telegram bots and Firebase back ends in near real time. The count of intercepted messages came to exactly 7,611,443. The victim tally comes from two channels: roughly 2,400 unique devices observed through installation notifications and about 15,600 more exposed through misconfigured Firebase infrastructure.

Activity against India's financial sector has been observed since July 2025, with related victim complaints going back to January 2025. The GitHub accounts used for distribution have since been taken down.

Seven malware families, one playbook

Seven distinct trojan families were identified in the campaign: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat and tenxen. GhostGrab, seen in earlier banking-theft campaigns, turned out to be an older build of GhostBat rather than an eighth family. Shared phishing themes alone were not enough to lump the samples together; the families differ in network traffic, database structures, message formats and command handling.

What they have in common is the toolkit: SMS interception and forwarding, call forwarding, and credential theft through convincing fake interfaces. Some talk to Telegram, some to Firebase, others to plain web servers.

Two details stand out. First, an administrative Android app was found that lets operators manage cyb3rx infections from a phone: browse intercepted messages, pull phished data, manage devices, send SMS, change forwarding rules, activate call forwarding and run custom USSD codes. Second, part of the infection chain includes a component called d-miner, which installs XMRig to mine cryptocurrency on the victim's device, using wake locks, silent audio playback and foreground services to avoid being killed by Android.

There are also signs that the GhostBat developers wrote and compiled their malware directly on Android phones. Whether every family belongs to the same operator remains unconfirmed: CyberDakait is best read as a cluster of overlapping campaign behaviour rather than a single proven group.

Why it matters

SMS is still the backbone of transaction authentication for many banks. A trojan that silently forwards one-time passcodes, combined with freshly phished card and login details, gives criminals everything they need to approve fraudulent transfers in real time. The stolen identity documents and photos also set victims up for follow-on impersonation long after the initial fraud.

The campaign also shows how low the barrier has become: free code-hosting repositories as malware distribution, consumer messaging bots as command-and-control, and a phone-based admin console for the operators.

What to do

For individuals:

  • Never install a banking app from a link received by call, SMS or WhatsApp. Use only the official store listing.
  • Treat any unsolicited "protection plan" or "cancellation" call as fraud. Hang up and call the number printed on your card.
  • Review which apps hold SMS permissions and revoke anything that does not need them.
  • If you suspect compromise, contact your bank immediately to freeze cards and accounts, then factory-reset the device.

For banks and fintechs:

  • Watch for lookalike domains built around "card protection", "cancel plan" and similar keywords, and for public repositories distributing APKs under your brand.
  • Push customers toward app-based or hardware-backed authentication where possible, and flag transactions that follow a burst of SMS forwarding or call-forwarding changes.
  • Keep an eye on underground and messaging-platform channels for your customers' leaked card data and credentials.

Campaigns like this one leave a trail outside your perimeter: intercepted messages, card dumps and credentials traded on Telegram channels and dark-web markets. 4tify's Deep/Dark Web monitoring is built to spot that kind of exposure early, so compromised accounts can be frozen before the fraud lands.

SHARE