Group-IB says a financially motivated campaign impersonating 11 Indian banks and two government schemes intercepted more than 7.6 million messages and stole banking data through malicious Android apps.
Group-IB says it has uncovered a sprawling Android fraud campaign that has been aimed at India’s financial services sector since at least July 2025, using fake calls, smishing and malicious app downloads to steal banking credentials, card data and one-time passwords. The threat intelligence company attributes the operation to a financially motivated cluster it tracks as CyberDakait, and says the same infrastructure has been used to push seven distinct malware families built to support both banking fraud and illicit cryptocurrency mining.
According to Group-IB, the campaign commonly begins with a phone call or message claiming a new credit card has been enrolled in a “Credit Card Protection Plan” that must be cancelled quickly to avoid charges. Victims are then sent to phishing pages designed to look like legitimate banking or government services, where any tap on a button such as “Login Now” or “Activate Protection” can trigger a silent APK download from GitHub-hosted repositories. Group-IB says the operators impersonated 11 Indian banks and two government schemes, using the same basic playbook across multiple brands to make the scam appear routine and urgent.
The malicious app chain is built to extract as much personal and financial data as possible. Group-IB says the first app often works as a dropper, presenting what looks like a Google Play update page while secretly installing a separate payload in the background. The fake verification flow then asks for card numbers, expiry dates and CVV codes, followed by banking login details, grid numbers, mobile numbers, PAN information, dates of birth and, at the final stage, images of the front and back of payment cards. The company also found that some samples requested battery-optimisation exclusions and accessibility permissions, steps that would help the malware remain active and evade Android’s restrictions.
The scale of the campaign is significant. Group-IB says it identified 2,364 unique victim devices from installation alerts, and then found a further 15,596 compromised devices through exposed Firebase infrastructure, taking the total to at least 17,960. Across those channels, the company says it saw 7,611,443 intercepted messages, including bank alerts, one-time passwords and other sensitive communications forwarded to attacker-controlled Telegram bots, Firebase nodes and remote servers. In multiple reported cases, victims lost more than $30,500 in total after being tricked by the fake protection-plan pitch.
Group-IB said the malware set includes cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat, also known as GhostGrab, and tenxen. While they share a common fraud objective, the company says the strains differ in their communications, database structures and telemetry formats, which is why it classifies them separately rather than as one codebase. It also found evidence that some of the developers used Android phones to build and compile the malware, and that one GitHub repository hosted an administrative controller app used to monitor victims and issue commands such as SMS forwarding, call forwarding and device management. Group-IB says it reported the related profiles and repositories to GitHub, which has since taken them down.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
