MR ROBOT Android MaaS rents bank trojans aimed at Indian customers
Original title: MR ROBOT Malware-as-a-Service Targets Indian Bank Customers
CloudSEK says one affiliate’s data held 5,407 texts from 153 devices, with call forwarding on 58 percent.
CloudSEK reported on October 28 that a malware-as-a-service branded MR ROBOT rents customized Android banking trojans to affiliates targeting Indian bank customers. Affiliates get their own application ID, a builder, and time-limited access through a version 7.0 panel and a Telegram storefront called APK Shield. The trojans intercept OTP texts, show fake screens for credentials and card data, and can enable call forwarding. CloudSEK tracked two affiliates, including one Firebase dataset of 153 devices and 5,407 messages collected July 16–30, 2026.
Unconfirmed: Infection and message counts come from CloudSEK’s view of affiliate panels and one exposed Firebase database.
- APK Shield offered about 36 lure apps impersonating banks, utilities, telecom, fines and government services.
- A second affiliate panel held about 154 devices and roughly 3,270 intercepted messages.
- About 4,000 of the second set came from bank and telecom short codes.
- Each build uses a fresh signing certificate and can hide from the Android launcher.
- CloudSEK links call forwarding and per-customer builders to FatBoyPanel and RedWing, previously noted by Zimperium.
Impact: OTPs, banking credentials, card data and call forwarding
| Product | Affected |
|---|---|
| Android | — |
- 1.Do not install bank-branded apps from links in text, WhatsApp or Telegram.
- 2.Banks should move customers from SMS OTPs toward app-based or FIDO authentication where feasible.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1111 Multi-Factor Authentication Interception
- Products
- Android
- Malware
- MR ROBOTFatBoyPanelRedWing
- Countries
- India
From the original article
2 min read at infosecurity-magazine.com
MR ROBOT Android malware rents banking trojans that steal one-time passwords and card data
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.