Emerging ThreatsMalware & Ransomware

MR ROBOT Malware Service Targets Indian Banks with Custom Trojans

Analyst 207||Source: InfoSecMag
A cluttered street market scene in an Indian city with mobile phone vendors and repair shops under warm daylight.

One affiliate intercepted 5,407 text messages from 153 infected devices, according to research published by CloudSEK on October 28, 2026.

MR ROBOT as a multi-tenant Android malware-as-a-service

CloudSEK’s analysis describes MR ROBOT not as a single campaign but as a multi-tenant crimeware platform that rents customized Android banking trojans to affiliates. The platform issues each affiliate a unique application ID and provides a malware builder that can generate bank-themed Android packages on demand. Access is licensed for set periods through a control panel identified as version 7.0 and the operation supports a tiered reseller model with sub-admin accounts, turning banking malware into a subscription-style offering.

APK Shield Telegram storefront and lure distribution

The operation’s distribution layer included a Telegram-based storefront: a bot named APK Shield that offered roughly 36 lure applications. Those lures impersonated banks and also posed as utility bill, telecom, traffic fine and government-service apps. Install links were pushed through fake Play Store–style pages and messaging-app links, according to CloudSEK.

Capabilities: SMS interception, fake screens, silent call forwarding

MR ROBOT builds are capable of intercepting text messages that carry one-time passwords (OTPs), presenting fake screens to harvest banking credentials, collecting card details, PINs and identity information, and silently enabling call forwarding. CloudSEK observed that call forwarding reroutes incoming calls—including banks’ fraud-check callbacks—to numbers under attackers’ control. Each malware build receives a fresh signing certificate and can hide from the Android launcher after installation.

CloudSEK tracked two affiliates during data collection between July 16 and 30, 2026. One affiliate’s panel showed about 154 enrolled devices and approximately 3,270 intercepted messages. An exposed Firebase database associated with a second affiliate contained records for 153 devices and 5,407 intercepted messages. Around 4,000 of those messages originated from bank and telecommunications short codes, and CloudSEK reported that call forwarding was active on 58% of the infected devices it observed.

Technical reuse: links to FatBoyPanel and RedWing

CloudSEK found that MR ROBOT shares particular components—specifically call forwarding and per-customer builders—with other crimeware operations known as FatBoyPanel and RedWing. Those operations were previously documented by Zimperium. CloudSEK noted, however, that MR ROBOT’s kit, its Telegram storefront and its control panel had not been publicly reported prior to this research.

What this means for banks, security teams, and end users

  • Banks: CloudSEK explicitly urged banks to move customers away from text-message OTPs toward app-based authentication or Fast Identity Online (FIDO) where feasible. The large share of intercepted messages coming from bank short codes underscores the operational risk when SMS remains a primary second factor for account access.
  • Security teams and platform defenders: The MR ROBOT model combines a builder, per-affiliate app signing, and a marketplace-style storefront. Teams should watch for indicators associated with fake Play Store pages, Telegram-distributed APKs, exposed Firebase instances and unusual call-forwarding changes on devices tied to business users or customer support channels.
  • End users: CloudSEK advised against installing bank-branded apps received via links in text messages, WhatsApp or Telegram. The combination of fake screens and the ability to hide from the Android launcher makes these lures harder to detect once installed.

The record CloudSEK captured—tens of thousands of intercepted messages across a small number of affiliates in a two-week window—illustrates the commoditization of mobile banking fraud: malware builders, a reseller model and a Telegram storefront together enable rapid, on-demand targeting of specific banks and services. CloudSEK’s final practical advice is direct: avoid installing bank-branded apps from messaging links and prioritize stronger authentication methods where possible.

Original story

Banking TrojanCybercrimeEmerging ThreatsIndiaMalware-As-A-ServiceMobile SecurityFinancial SectorAndroid MalwareMR ROBOT
Related Intelligence

Continue Reading

Network operations room with equipment and topology map on large screen display.

Cisco SD-WAN Flaw Exploited to Plant KeyDrift Malware

A critical Cisco SD-WAN flaw, rated a maximum severity score of 10.0, has been exploited by attackers to plant custom malware, known as KeyDrift, inside targeted systems, allowing them to bypass authentication and gain administrative privileges. This vulnerability puts organizations at risk, as it enables hackers to gain high-level access to SD-WAN networks.

Analyst 207
Network operations center with a workstation and large security appliance in the background.

Palo Alto Networks Management Interfaces Targeted by PHP2Shell Exploits

Palo Alto Networks is warning of active exploits targeting its management interfaces, specifically the PHP2Shell vulnerabilities, that could put publicly accessible interfaces at risk. Immediate action is crucial, as threat actors are taking advantage of recently patched weaknesses in the company's management web interface and XML API service.

Analyst 207
Server equipment in a data center with a single device in sharp focus.

China-Linked Hackers Exploit VMware ESX Flaw to Evade Audit Trails

A newly discovered VMware ESX flaw, CVE-2026-41709, has been exploited by China-linked hackers to evade detection, highlighting a critical logging gap that allowed malicious activities to go unrecorded. Broadcom has since released fixes to address this vulnerability.

Analyst 207
Serene rural scene in Madagascar with scattered items outside a simple, single-story building.

US Prosecutors Target African Scammers in $516,695 NFT Theft Scheme

Meet the scammers who posed as gorgeous women on dating sites, charming victims into connecting their crypto wallets to fake NFT investment sites, leading to a staggering $516,695 theft. US prosecutors have charged six individuals linked to a Madagascar-based compound behind the elaborate NFT investment scam.

Analyst 207