CyberDakait malware hits 17,960 Indian banking Android devices
Original title: CyberDakait Hackers Target Indian Banking Users, Compromise 17,960 Android Devices
Operators intercepted 7,611,443 SMS messages and paired credential theft with XMRig mining on idle phones.
Group-IB describes CyberDakait as a financially motivated Android operation targeting Indian banking customers since July 2025. Callers posing as bank staff push phishing sites that deliver malicious APKs, including via GitHub, then a fake Play update installs a dropper with remote access and mining. The campaign impersonates 11 Indian banks and two government programs across seven malware families.
Unconfirmed: Group-IB clusters the families by shared infrastructure; earlier Cyble and CYFIRMA reports do not independently attribute them to CyberDakait.
- Researchers counted 2,364 device UUIDs plus 15,596 devices in exposed Firebase data.
- Stolen data includes card details, banking credentials, PAN, Aadhaar, and photographs.
- Mining via d-miner stops when the phone is unlocked.
- Families include cyb3rx, GhostBat, tenxen, and GhostGrab, tracked with GhostBat.
Impact: Banking credentials, OTPs, identity documents, and remote control
- 1.Install banking apps only from verified channels and contact the bank after suspected exposure.
- 2.Review unexpected SMS permissions, fake update screens, and persistent background services.
- 3.Enable Play Protect and investigate unexplained overheating or battery drain.
- Products
- Android
- Threat actors
- CyberDakait
- Countries
- India
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 81service.icu | Indicators of Compromise Category Indicator Phishing domain 81service[.]icu Phishing domain 81service[.]in Phishing domain Imanagec[. |
| domain | 81service.in | y Indicator Phishing domain 81service[.]icu Phishing domain 81service[.]in Phishing domain Imanagec[.]online Phishing domain applypo |
| domain | applypointguides.in | vice[.]in Phishing domain Imanagec[.]online Phishing domain applypointguides[.]in C2 IP address 64.89.163[.]3 C2 IP address 78.159.156[.]74 |
| domain | imanagec.online | ervice[.]icu Phishing domain 81service[.]in Phishing domain Imanagec[.]online Phishing domain applypointguides[.]in C2 IP address 64.89 |
| ipv4 | 144.31.244.184 | s 64.89.163[.]3 C2 IP address 78.159.156[.]74 C2 IP address 144.31.244[.]184 C2 IP address 46.151.182[.]28 Note: IP addresses and doma |
| ipv4 | 46.151.182.28 | 8.159.156[.]74 C2 IP address 144.31.244[.]184 C2 IP address 46.151.182[.]28 Note: IP addresses and domains are intentionally defanged |
| ipv4 | 64.89.163.3 | ]online Phishing domain applypointguides[.]in C2 IP address 64.89.163[.]3 C2 IP address 78.159.156[.]74 C2 IP address 144.31.244[.] |
| ipv4 | 78.159.156.74 | ypointguides[.]in C2 IP address 64.89.163[.]3 C2 IP address 78.159.156[.]74 C2 IP address 144.31.244[.]184 C2 IP address 46.151.182[. |
From the original article
3 min read at gbhackers.com
CyberDakait, a financially motivated Android malware operation targeting Indian banking customers since July 2025. Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages, exposing a campaign that combines banking credential theft, remote device control, and cryptocurrency mining.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.