A fake traffic-fine app linked to a live criminal control panel shows how attackers are industrialising the theft of card details, UPI PINs and one-time passcodes.
The operation described in the lead article shows how industrialised mobile fraud has become: a smishing campaign, a multi-stage Android trojan and a back-end control panel were tied together into a service that could steal card details, UPI PINs and intercepted SMS messages in real time. The lure was simple enough to fool hurried users: a spoofed traffic fine alert that pushed them towards a fake app. Once installed, the malware funnelled victims into a payment flow that looked routine but was designed to harvest credentials and route one-time passcodes back to the operators almost instantly.
That approach fits a wider pattern seen across recent cybercrime campaigns. Cyfirma has documented a two-stage Android spyware operation that abused the “Red Alert” civil defence app in Israel, using SMS phishing to push trojanised APKs and then loading a much larger spyware payload at runtime. Elsewhere, LevelBlue has tracked a separate fake CAPTCHA campaign that used compromised websites as a delivery layer for multiple malware families, underscoring how modular criminal infrastructure now tends to be. The common thread is flexibility: the lure changes, but the distribution logic and the theft pipeline remain reusable.
In this case, the operator’s infrastructure was unusually exposed. The report describes a dashboard built as a web application rather than a native admin tool, complete with live device lists, SMS streams, share tokens and build queues. The same system also exposed APIs for user management, billing and APK templates, along with authentication and device-registration logic that could be reverse-engineered from the panel’s own documentation. According to the analysis, the operators relied on a web stack that left traces in cloud hosting, certificate records and code repositories, making the operation easier to map than many criminal services of its kind.
The malware itself was layered and heavily customised. The outer package concealed a compressed inner bundle that, once decrypted, revealed a split APK set containing the real Android RAT. The inner build impersonated a mParivahan-style application and requested invasive permissions, including access to SMS, calls and battery optimisation controls. It also carried a fake payment sequence that displayed screens for challan details, payment methods, card entry and UPI PIN submission, while quietly pushing those fields into a remote database tied to the attackers’ panel.
What made the campaign especially damaging was the way it handled SMS interception and relay. Rather than simply stealing data for later use, the operators had built a live forwarding loop that could pass bank verification messages through a victim’s own phone number, a critical step in account takeover and payment fraud. Zimperium has warned that SMS-stealer campaigns increasingly focus on this exact choke point, because control of the victim’s messaging channel can defeat many banking and identity checks. Group-IB’s analysis of the Smishing Triad similarly shows how real-time victim control has become central to large-scale phishing operations.
The report goes further, arguing that the operators’ own environment became a source of evidence. Logs, build histories, account data and encrypted keys were allegedly recovered from the backend, along with enough operational detail to map customers, operators and payment flows. That sort of leakage is increasingly important to defenders, because it can link a phishing kit to its victims, its relays and its money trail. Rescana’s research into the Smishing Triad found more than 194,000 malicious domains since early 2024, illustrating just how large the smishing ecosystem has become and how much of it depends on disposable infrastructure and repeatable scripts.
The broader lesson is not just that one gang was careless. It is that mobile fraud now resembles software-as-a-service: lure kits, malware loaders, webhook back ends, Telegram automation and cloud dashboards all stitched together into a single criminal product. Microsoft’s recent analysis of Tycoon2FA, a phishing platform built to capture session cookies and MFA codes, points to the same commercial logic on the desktop side of the fraud market. For defenders, that means disruption has to go beyond takedowns of single domains. It also has to target the back-end plumbing, the operator accounts, the payment rails and the reuse patterns that make one campaign look like the last.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
