Malwarehigh
Banking trojans infect 17,960 Android phones in India
Original title: Hackers Infect 17,960 Android Phones With Banking Trojans, Steal 7.6 Million SMS Messages
AI summary · x-ai/grok-4.7Summaries by Vani AI
Group-IB says seven families intercepted 7,611,443 SMS messages and stole cards, OTPs, and identity data.
Group-IB says a financially motivated campaign it tracks as CyberDakait compromised at least 17,960 Android devices in India and intercepted 7,611,443 SMS messages. Attackers impersonated 11 Indian banks and two government programs with fake calls, phishing sites, and malicious APKs. Seven families share SMS theft, call forwarding, and financial-data theft; d-miner also runs XMRig. GitHub repositories reported by Group-IB were later deactivated.
Unconfirmed: Group-IB does not establish that every related Trojan belongs to one operator.
Key facts
- Counts came from 2,364 install notifications and 15,596 devices via exposed Firebase.
- Activity targeting Indian financial services is described since July 2025.
- Named families are cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat, and tenxen.
- GhostGrab is described as an older GhostBat version, not a separate family.
- Operators could send SMS, change forwarding, and run custom USSD requests.
Security assessment · AI, from the article
Impact: Stolen banking credentials, card data, OTPs, and identity documents
What to do
- 1.Reject banking apps delivered through unsolicited links.
- 2.Verify unexpected bank calls using official contact details.
- 3.Contact the bank immediately to freeze exposed accounts.
- ATT&CK
- T1566.004 Spearphishing VoiceT1566.002 Spearphishing LinkT1204.002 User Execution: Malicious FileT1496 Resource Hijacking
- Products
- Android
- Threat actors
- CyberDakait
- Organizations
- Group-IB
- Countries
- India
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 81service.icu | oCs):- Indicator type Source-listed values Phishing domains 81service[.]icu 81service[.]in Imanagec[.]online applypointguides[.]in ca |
| domain | 81service.in | type Source-listed values Phishing domains 81service[.]icu 81service[.]in Imanagec[.]online applypointguides[.]in cancelcardprotect |
| domain | app2-update2.site | com:9000 pool-proxy.fud2026[.]com:9000 install-update[.]xyz app2-update2[.]site update-app[.]online Controller API examples hXXp://64.89[ |
| domain | applypointguides.in | ng domains 81service[.]icu 81service[.]in Imanagec[.]online applypointguides[.]in cancelcardprotection[.]online cancelcpservice[.]in cancel |
| domain | cancelcardprotection.online | ]icu 81service[.]in Imanagec[.]online applypointguides[.]in cancelcardprotection[.]online cancelcpservice[.]in cancelmyservice[.]in cancelservice[. |
| domain | cancelcpservice.in | ]online applypointguides[.]in cancelcardprotection[.]online cancelcpservice[.]in cancelmyservice[.]in cancelservice[.]in cardforex[.]icu c |
| domain | cancelmyservice.in | des[.]in cancelcardprotection[.]online cancelcpservice[.]in cancelmyservice[.]in cancelservice[.]in cardforex[.]icu cardplan[.]online card |
| domain | cancelservice.in | otection[.]online cancelcpservice[.]in cancelmyservice[.]in cancelservice[.]in cardforex[.]icu cardplan[.]online cardprotections[.]in ca |
| domain | cardforex.icu | ancelcpservice[.]in cancelmyservice[.]in cancelservice[.]in cardforex[.]icu cardplan[.]online cardprotections[.]in cardsprotection[.] |
| domain | cardplan.online | ]in cancelmyservice[.]in cancelservice[.]in cardforex[.]icu cardplan[.]online cardprotections[.]in cardsprotection[.]in cardsprotection |
| domain | cardprotections.in | e[.]in cancelservice[.]in cardforex[.]icu cardplan[.]online cardprotections[.]in cardsprotection[.]in cardsprotection[.]online careidf[.]o |
| domain | cardsprotection.in | .]in cardforex[.]icu cardplan[.]online cardprotections[.]in cardsprotection[.]in cardsprotection[.]online careidf[.]online carep[.]online |
| domain | cardsprotection.online | cardplan[.]online cardprotections[.]in cardsprotection[.]in cardsprotection[.]online careidf[.]online carep[.]online cpmanaged[.]in cppmanage[ |
| domain | careidf.online | tections[.]in cardsprotection[.]in cardsprotection[.]online careidf[.]online carep[.]online cpmanaged[.]in cppmanage[.]in deactivatecp |
| domain | carep.online | dsprotection[.]in cardsprotection[.]online careidf[.]online carep[.]online cpmanaged[.]in cppmanage[.]in deactivatecpplan[.]in deact |
| domain | cpmanaged.in | in cardsprotection[.]online careidf[.]online carep[.]online cpmanaged[.]in cppmanage[.]in deactivatecpplan[.]in deactivatecpservice[ |
| domain | cppmanage.in | ion[.]online careidf[.]online carep[.]online cpmanaged[.]in cppmanage[.]in deactivatecpplan[.]in deactivatecpservice[.]in hamzaansar |
| domain | deactivatecpplan.in | reidf[.]online carep[.]online cpmanaged[.]in cppmanage[.]in deactivatecpplan[.]in deactivatecpservice[.]in hamzaansari1612-ux[.]github[.]io |
| domain | deactivatecpservice.in | ]online cpmanaged[.]in cppmanage[.]in deactivatecpplan[.]in deactivatecpservice[.]in hamzaansari1612-ux[.]github[.]io hdmanage[.]online icppus |
| domain | fud2026.com | .163[.]4 aptabase[.]fud2026.xyz:8443 accessor[.]fud2026.com fud2026[.]com pool.fud2026[.]com:9000 pool-proxy.fud2026[.]com:9000 ins |
| domain | hamzaansari1612-ux.github.io | pmanage[.]in deactivatecpplan[.]in deactivatecpservice[.]in hamzaansari1612-ux[.]github[.]io hdmanage[.]online icppuser[.]in icppuser[.]online icser |
| domain | hdmanage.online | n deactivatecpservice[.]in hamzaansari1612-ux[.]github[.]io hdmanage[.]online icppuser[.]in icppuser[.]online icservice[.]online icuser |
| domain | icppuser.in | ice[.]in hamzaansari1612-ux[.]github[.]io hdmanage[.]online icppuser[.]in icppuser[.]online icservice[.]online icuser[.]online idca |
| domain | icppuser.online | ansari1612-ux[.]github[.]io hdmanage[.]online icppuser[.]in icppuser[.]online icservice[.]online icuser[.]online idcare[.]in idfcare[.] |
| domain | icservice.online | thub[.]io hdmanage[.]online icppuser[.]in icppuser[.]online icservice[.]online icuser[.]online idcare[.]in idfcare[.]in idmanagecp[.]onl |
| domain | icuser.online | .]online icppuser[.]in icppuser[.]online icservice[.]online icuser[.]online idcare[.]in idfcare[.]in idmanagecp[.]online idservice[.] |
| domain | idcare.in | r[.]in icppuser[.]online icservice[.]online icuser[.]online idcare[.]in idfcare[.]in idmanagecp[.]online idservice[.]in Phishing |
| domain | idfcare.in | ser[.]online icservice[.]online icuser[.]online idcare[.]in idfcare[.]in idmanagecp[.]online idservice[.]in Phishing domains, cont |
| domain | idmanagecp.online | icservice[.]online icuser[.]online idcare[.]in idfcare[.]in idmanagecp[.]online idservice[.]in Phishing domains, continued imobile[.]serv |
| domain | idservice.in | cuser[.]online idcare[.]in idfcare[.]in idmanagecp[.]online idservice[.]in Phishing domains, continued imobile[.]services imobilelit |
| domain | imanagec.online | sted values Phishing domains 81service[.]icu 81service[.]in Imanagec[.]online applypointguides[.]in cancelcardprotection[.]online cance |
| domain | imobilelite.in | service[.]in Phishing domains, continued imobile[.]services imobilelite[.]in imobileservices[.]online indeemanage[.]in indemanage[.]in |
| domain | imobile.services | anagecp[.]online idservice[.]in Phishing domains, continued imobile[.]services imobilelite[.]in imobileservices[.]online indeemanage[.]i |
| domain | imobileservices.online | hing domains, continued imobile[.]services imobilelite[.]in imobileservices[.]online indeemanage[.]in indemanage[.]in indiuser[.]com inducare[ |
| domain | indeemanage.in | mobile[.]services imobilelite[.]in imobileservices[.]online indeemanage[.]in indemanage[.]in indiuser[.]com inducare[.]online managebw |
| domain | indemanage.in | imobilelite[.]in imobileservices[.]online indeemanage[.]in indemanage[.]in indiuser[.]com inducare[.]online managebworld[.]com manag |
| domain | indiuser.com | n imobileservices[.]online indeemanage[.]in indemanage[.]in indiuser[.]com inducare[.]online managebworld[.]com managecare[.]in mana |
| domain | inducare.online | es[.]online indeemanage[.]in indemanage[.]in indiuser[.]com inducare[.]online managebworld[.]com managecare[.]in managecare[.]online ma |
| domain | install-update.xyz | .]com pool.fud2026[.]com:9000 pool-proxy.fud2026[.]com:9000 install-update[.]xyz app2-update2[.]site update-app[.]online Controller API ex |
| domain | managebworld.com | anage[.]in indemanage[.]in indiuser[.]com inducare[.]online managebworld[.]com managecare[.]in managecare[.]online managecp[.]co[.]in ma |
| domain | managecare.in | ge[.]in indiuser[.]com inducare[.]online managebworld[.]com managecare[.]in managecare[.]online managecp[.]co[.]in managecp[.]com man |
| domain | managecare.online | [.]com inducare[.]online managebworld[.]com managecare[.]in managecare[.]online managecp[.]co[.]in managecp[.]com manageici[.]com managei |
| domain | managecp.co.in | line managebworld[.]com managecare[.]in managecare[.]online managecp[.]co[.]in managecp[.]com manageici[.]com manageinsurances[.]onlin |
| domain | managecp.com | ]com managecare[.]in managecare[.]online managecp[.]co[.]in managecp[.]com manageici[.]com manageinsurances[.]online manageprotectio |
| domain | manageici.com | [.]in managecare[.]online managecp[.]co[.]in managecp[.]com manageici[.]com manageinsurances[.]online manageprotection[.]in managepro |
| domain | manageinsurances.online | [.]online managecp[.]co[.]in managecp[.]com manageici[.]com manageinsurances[.]online manageprotection[.]in manageprotectionplan[.]in managepro |
| domain | manageprotection.in | in managecp[.]com manageici[.]com manageinsurances[.]online manageprotection[.]in manageprotectionplan[.]in manageprotections[.]com myicuse |
| domain | manageprotectionplan.in | geici[.]com manageinsurances[.]online manageprotection[.]in manageprotectionplan[.]in manageprotections[.]com myicuser[.]in myinsuranceservice[ |
| domain | manageprotections.com | es[.]online manageprotection[.]in manageprotectionplan[.]in manageprotections[.]com myicuser[.]in myinsuranceservice[.]in mypnhelp[.]online m |
| domain | myicuser.in | tion[.]in manageprotectionplan[.]in manageprotections[.]com myicuser[.]in myinsuranceservice[.]in mypnhelp[.]online mypolicyservice |
| domain | myinsuranceservice.in | geprotectionplan[.]in manageprotections[.]com myicuser[.]in myinsuranceservice[.]in mypnhelp[.]online mypolicyservice[.]in pmanage[.]online p |
| domain | mypnhelp.online | nageprotections[.]com myicuser[.]in myinsuranceservice[.]in mypnhelp[.]online mypolicyservice[.]in pmanage[.]online pncare[.]online pol |
| domain | mypolicyservice.in | com myicuser[.]in myinsuranceservice[.]in mypnhelp[.]online mypolicyservice[.]in pmanage[.]online pncare[.]online policydeactivate[.]in pr |
| domain | pmanage.online | nsuranceservice[.]in mypnhelp[.]online mypolicyservice[.]in pmanage[.]online pncare[.]online policydeactivate[.]in protectcc[.]online |
| domain | pncare.online | ]in mypnhelp[.]online mypolicyservice[.]in pmanage[.]online pncare[.]online policydeactivate[.]in protectcc[.]online protectionmanage |
| domain | policydeactivate.in | nline mypolicyservice[.]in pmanage[.]online pncare[.]online policydeactivate[.]in protectcc[.]online protectionmanage[.]online rohansingh25 |
| domain | protectcc.online | .]in pmanage[.]online pncare[.]online policydeactivate[.]in protectcc[.]online protectionmanage[.]online rohansingh253641-spec[.]github[ |
| domain | protectionmanage.online | ne pncare[.]online policydeactivate[.]in protectcc[.]online protectionmanage[.]online rohansingh253641-spec[.]github[.]io secureici[.]online se |
| domain | rohansingh253641-spec.github.io | eactivate[.]in protectcc[.]online protectionmanage[.]online rohansingh253641-spec[.]github[.]io secureici[.]online servicecpp[.]in serviceic[.]in servi |
| domain | secureici.online | otectionmanage[.]online rohansingh253641-spec[.]github[.]io secureici[.]online servicecpp[.]in serviceic[.]in serviceici[.]in serviceidf |
| domain | servicecpp.com | [.]online www.protectcc[.]online www.secureici[.]online www.servicecpp[.]com www.serviceic[.]com C2 addresses and associated infrastru |
| domain | servicecpp.in | line rohansingh253641-spec[.]github[.]io secureici[.]online servicecpp[.]in serviceic[.]in serviceici[.]in serviceidf[.]in serviceidf |
| domain | serviceic.com | cc[.]online www.secureici[.]online www.servicecpp[.]com www.serviceic[.]com C2 addresses and associated infrastructure 64.89.163[.]3 |
| domain | serviceici.in | thub[.]io secureici[.]online servicecpp[.]in serviceic[.]in serviceici[.]in serviceidf[.]in serviceidf[.]online servicescard[.]online |
| domain | serviceic.in | 53641-spec[.]github[.]io secureici[.]online servicecpp[.]in serviceic[.]in serviceici[.]in serviceidf[.]in serviceidf[.]online servi |
| domain | serviceidf.in | ici[.]online servicecpp[.]in serviceic[.]in serviceici[.]in serviceidf[.]in serviceidf[.]online servicescard[.]online serviceshelp[.] |
| domain | serviceidf.online | vicecpp[.]in serviceic[.]in serviceici[.]in serviceidf[.]in serviceidf[.]online servicescard[.]online serviceshelp[.]online suraj527526-c |
| domain | servicescard.online | ic[.]in serviceici[.]in serviceidf[.]in serviceidf[.]online servicescard[.]online serviceshelp[.]online suraj527526-cmyk[.]github[.]io www. |
| domain | serviceshelp.online | n serviceidf[.]in serviceidf[.]online servicescard[.]online serviceshelp[.]online suraj527526-cmyk[.]github[.]io www.icppuser[.]online www. |
| domain | suraj527526-cmyk.github.io | iceidf[.]online servicescard[.]online serviceshelp[.]online suraj527526-cmyk[.]github[.]io www.icppuser[.]online www.icuser[.]online www.protectcc |
| domain | update-app.online | fud2026[.]com:9000 install-update[.]xyz app2-update2[.]site update-app[.]online Controller API examples hXXp://64.89[.]163.3/idfc/1/api/ |
| ipv4 | 144.31.244.184 | and associated infrastructure 64.89.163[.]3 78.159.156[.]74 144.31.244[.]184 46.151.182[.]28 ws://64.89[.]163.3:8082 64.89.163[.]4 apt |
| ipv4 | 46.151.182.28 | frastructure 64.89.163[.]3 78.159.156[.]74 144.31.244[.]184 46.151.182[.]28 ws://64.89[.]163.3:8082 64.89.163[.]4 aptabase[.]fud2026. |
| ipv4 | 64.89.163.3 | .serviceic[.]com C2 addresses and associated infrastructure 64.89.163[.]3 78.159.156[.]74 144.31.244[.]184 46.151.182[.]28 ws://64. |
| ipv4 | 64.89.163.4 | 74 144.31.244[.]184 46.151.182[.]28 ws://64.89[.]163.3:8082 64.89.163[.]4 aptabase[.]fud2026.xyz:8443 accessor[.]fud2026.com fud202 |
| ipv4 | 78.159.156.74 | om C2 addresses and associated infrastructure 64.89.163[.]3 78.159.156[.]74 144.31.244[.]184 46.151.182[.]28 ws://64.89[.]163.3:8082 |
| sha256 | 04b35b0c199ef8a13d6ac18dfc6df2ea66a8ed5b6e464dc3a7db0839093882bd | ef6878a4e7b43468546db77f095517b15b56 d-passive.TradeSignals 04b35b0c199ef8a13d6ac18dfc6df2ea66a8ed5b6e464dc3a7db0839093882bd tenxen d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf1 |
| sha256 | 0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856 | ching and investigation. Source family label SHA-256 cyberx 0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856 cyberx 1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65 |
| sha256 | 1b9052d85e12573b4f64f6a47f64803007b19990def1bc62a865de00149a825e | 73d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8 godz 1b9052d85e12573b4f64f6a47f64803007b19990def1bc62a865de00149a825e godz 5c0f8bca492c9ee79d6bbd7a532945514670321a605002987f69e3 |
| sha256 | 1bfaaa9aed67552a2c368df3f264ef6878a4e7b43468546db77f095517b15b56 | d90aa35a3a04b48839f86282678107f7876d d-passive.ExampleAdmin 1bfaaa9aed67552a2c368df3f264ef6878a4e7b43468546db77f095517b15b56 d-passive.TradeSignals 04b35b0c199ef8a13d6ac18dfc6df2ea66a8 |
| sha256 | 1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624 | 3677488018061b109bba59b1a518c8f33b48de31ec532be69856 cyberx 1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624 cyberx 2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f04 |
| sha256 | 2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f | 17cfbfce980fefa926a847964bcc7b047908db65161148d0f624 cyberx 2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f cyberx 3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f |
| sha256 | 34b75b78b6c575c8a9e71f712be9d90aa35a3a04b48839f86282678107f7876d | c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6 ghostbat 34b75b78b6c575c8a9e71f712be9d90aa35a3a04b48839f86282678107f7876d d-passive.ExampleAdmin 1bfaaa9aed67552a2c368df3f264ef6878a4 |
| sha256 | 3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921 | 6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f cyberx 3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921 cyberx 5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bff |
| sha256 | 3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc | 754ad735b460be67e344c5939d9cff498ce1d95bf554b93fc1b d-shine 3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc appkjl 555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd |
| sha256 | 431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa | 9d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a cyberx 431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa cyberx 902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa |
| sha256 | 43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6 | 9e9a28fd129a32064d78628289eac72d47f53d63cbc434de41 ghostbat 43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6 ghostbat 34b75b78b6c575c8a9e71f712be9d90aa35a3a04b48839f862 |
| sha256 | 47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112beca186d844a | f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d cyberx 47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112beca186d844a cyberx 65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a3 |
| sha256 | 4a17171155997754ad735b460be67e344c5939d9cff498ce1d95bf554b93fc1b | ef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f tenxen 4a17171155997754ad735b460be67e344c5939d9cff498ce1d95bf554b93fc1b d-shine 3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835f |
| sha256 | 53f9fcf3a6fdc59e9a28fd129a32064d78628289eac72d47f53d63cbc434de41 | 2c9ee79d6bbd7a532945514670321a605002987f69e3331110e447 godz 53f9fcf3a6fdc59e9a28fd129a32064d78628289eac72d47f53d63cbc434de41 ghostbat 43b217184f7765c699fd887fe22c07c7656483dc088e021458 |
| sha256 | 555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd1bdeb843570f | d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc appkjl 555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd1bdeb843570f Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4 | 4d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921 cyberx 5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4 cyberx 5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb |
| sha256 | 5c0f8bca492c9ee79d6bbd7a532945514670321a605002987f69e3331110e447 | 12573b4f64f6a47f64803007b19990def1bc62a865de00149a825e godz 5c0f8bca492c9ee79d6bbd7a532945514670321a605002987f69e3331110e447 godz 53f9fcf3a6fdc59e9a28fd129a32064d78628289eac72d47f53d63 |
| sha256 | 5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456 | a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4 cyberx 5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456 cyberx 7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f |
| sha256 | 65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68 | 143798a70805a23eb294fc072170dac19c1fa112beca186d844a cyberx 65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68 cyberx 80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04 |
| sha256 | 7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d | 55aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456 cyberx 7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d cyberx 47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112 |
| sha256 | 80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a | 849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68 cyberx 80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a cyberx 431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae |
| sha256 | 902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b | 52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa cyberx 902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b cyberx b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1c |
| sha256 | 9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8 | 7f552deb7ff04f5c598a81be4d236fe33adca2a47551485a3aeb2a godz 9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8 godz 1b9052d85e12573b4f64f6a47f64803007b19990def1bc62a865de |
| sha256 | b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9 | 0d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b cyberx b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9 cyberx b332fa9c08020fbbc5503091b4f4a61ee66a05a0a76abf9a53db |
| sha256 | b332fa9c08020fbbc5503091b4f4a61ee66a05a0a76abf9a53db9f3d80c4862a | 979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9 cyberx b332fa9c08020fbbc5503091b4f4a61ee66a05a0a76abf9a53db9f3d80c4862a cyberx c9ead89d1bcb09923e1057bb4617726867154d36932ed1c2f82c |
| sha256 | c36d2b4480034a409f33cdef8d7c3501e75f14d2c5bd9a914a65fd7f3c47d74a | 09923e1057bb4617726867154d36932ed1c2f82c2466bf11934c cyberx c36d2b4480034a409f33cdef8d7c3501e75f14d2c5bd9a914a65fd7f3c47d74a cyberx c6708166e0a6bf3484200fd6dd1569d89e81c36ffd76ff2ab582 |
| sha256 | c6708166e0a6bf3484200fd6dd1569d89e81c36ffd76ff2ab5820b06fd2d5b54 | 4a409f33cdef8d7c3501e75f14d2c5bd9a914a65fd7f3c47d74a cyberx c6708166e0a6bf3484200fd6dd1569d89e81c36ffd76ff2ab5820b06fd2d5b54 cyberx cb86017411708eb6e5384fc0288b0ec4692ea45ef38586b7c67f |
| sha256 | c9ead89d1bcb09923e1057bb4617726867154d36932ed1c2f82c2466bf11934c | 0fbbc5503091b4f4a61ee66a05a0a76abf9a53db9f3d80c4862a cyberx c9ead89d1bcb09923e1057bb4617726867154d36932ed1c2f82c2466bf11934c cyberx c36d2b4480034a409f33cdef8d7c3501e75f14d2c5bd9a914a65 |
| sha256 | cb86017411708eb6e5384fc0288b0ec4692ea45ef38586b7c67f99148e1117c3 | bf3484200fd6dd1569d89e81c36ffd76ff2ab5820b06fd2d5b54 cyberx cb86017411708eb6e5384fc0288b0ec4692ea45ef38586b7c67f99148e1117c3 cyberx cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d |
| sha256 | cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7 | 8eb6e5384fc0288b0ec4692ea45ef38586b7c67f99148e1117c3 cyberx cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7 cyberx cf66a1acebd878d85345377be53ac0b241f517253811ec969c8f |
| sha256 | cf66a1acebd878d85345377be53ac0b241f517253811ec969c8ff9c751151424 | 0501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7 cyberx cf66a1acebd878d85345377be53ac0b241f517253811ec969c8ff9c751151424 cyberx dfa02773f97f552deb7ff04f5c598a81be4d236fe33adca2a475 |
| sha256 | d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f | f8a13d6ac18dfc6df2ea66a8ed5b6e464dc3a7db0839093882bd tenxen d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f tenxen 4a17171155997754ad735b460be67e344c5939d9cff498ce1d95 |
| sha256 | dfa02773f97f552deb7ff04f5c598a81be4d236fe33adca2a47551485a3aeb2a | 78d85345377be53ac0b241f517253811ec969c8ff9c751151424 cyberx dfa02773f97f552deb7ff04f5c598a81be4d236fe33adca2a47551485a3aeb2a godz 9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1 |
| url | http://64.89.163.3/idfc/1/api/ | -update2[.]site update-app[.]online Controller API examples hXXp://64.89[.]163.3/idfc/1/api/ hXXp://64.89[.]163.3/pnb/1/api/ Malicious GitHub accounts |
| url | http://64.89.163.3/pnb/1/api/ | ne Controller API examples hXXp://64.89[.]163.3/idfc/1/api/ hXXp://64.89[.]163.3/pnb/1/api/ Malicious GitHub accounts and repository paths muhaamad85 |
From the original article
4 min read at cybersecuritynews.com
Hackers have compromised at least 17,960 Android devices and intercepted more than 7. 6 million SMS messages in a banking malware campaign targeting India. The operation combines fake bank calls, phishing websites, malicious applications, and cryptocurrency mining to steal financial information while quietly exploiting infected phones.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.