Group-IB says seven trojan families and a cryptocurrency miner were used to steal banking details and intercept more than 7.6 million text messages.
Group-IB researchers have uncovered what they describe as a sprawling Android malware operation aimed at Indian banking customers, with at least 17,960 compromised devices, more than 7.6 million intercepted text messages and a set of seven trojan families working alongside a cryptocurrency miner. The security firm said the campaign, which it tracks under the name CyberDakait, has relied on vishing calls and WhatsApp or SMS lures to push victims towards fake bank pages and malicious Android apps hosted on GitHub. Group-IB said the activity has been tied to attacks on customers of 11 Indian banks and two government programmes, with losses in cited cases exceeding $30,500.
According to Group-IB, the scheme typically begins with a caller contacting a new cardholder and warning that an automatic “Credit Card Protection Plan” fee will soon be charged unless it is cancelled at once. The victim is then sent a link to a phishing page designed to mimic a bank or public-service portal. CYFIRMA has separately documented similar Android banking scams distributed through WhatsApp, showing how a seemingly legitimate verification app can install a hidden second-stage payload, request risky permissions and keep running in the background while stealing messages and other data.
Group-IB said the initial malicious app in the CyberDakait campaign acts as a dropper known as d-miner. Once installed, it shows a counterfeit Google Play update screen, pushes the user to disable battery optimisation and then quietly loads a second payload while also decrypting code to run an XMRig cryptocurrency miner. The report said the malware uses wake locks, foreground notifications and other tricks to stay active, while the broader set of payloads includes cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat, GhostGrab and tenxen.
The fraud itself is staged in four steps, with each screen designed to harvest a different set of details. Victims are first asked for card numbers, expiry dates and CVV codes, then for online banking credentials and security-grid numbers under a know-your-customer pretext. Next come mobile number, date of birth and Permanent Account Number details, followed by a request for an image of the front of the card. Group-IB said the stolen information was routed through Telegram bots, Firebase databases and remote servers depending on the malware family, while CYFIRMA’s research on related Android banking threats similarly found abuse of SMS interception, call forwarding and USSD commands.
Group-IB said its analysis of Telegram installation alerts and exposed Firebase data pointed to a wide infection base, with 2,364 unique devices identified from alerts and another 15,596 found in cloud storage records. The firm said it reported the GitHub repositories involved, after which the accounts were taken down. The company also said developers behind the GhostBat line appeared to have built and compiled code on Android phones using mobile tools, suggesting a fragmented but coordinated ecosystem rather than a single, formally named group. Its advice to users is straightforward: do not install banking apps from links sent by text or messaging apps, verify any unexpected card-related call through official bank numbers, and immediately contact the bank if details were entered into a suspicious app.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
