Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

CyberDakait hit 17,960 Indian Android phones, stole millions of SMS

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Group-IB says CyberDakait compromised at least 17,960 Indian Android devices and intercepted 7,611,443 SMS messages.

Group-IB says CyberDakait, active since July 2025, compromised at least 17,960 Android phones of Indian banking customers and intercepted 7,611,443 SMS messages. Callers posing as bank staff sent victims to phishing sites and malicious APKs, including GitHub copies later deactivated; a fake Play update installed remote access and d-miner XMRig that pauses when the phone unlocks. Operators impersonated 11 banks and two government programs with seven families that steal cards, OTPs, credentials, PAN, Aadhaar data, and photos, and can forward calls or send USSD codes. The device total combines 2,364 install notifications with 15,596 records in exposed Firebase data. GBHackers includes GhostGrab as a family; Cyber Security News calls it an older GhostBat version.

Key facts
  • Targeting of Indian financial services described since July 2025.
  • Impersonated 11 Indian banks and two government programs.
  • Counts: 2,364 install records plus 15,596 Firebase device records.
  • Shared capabilities include SMS theft, call forwarding, and financial-data theft.
  • Cyber Security News names cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat, and tenxen.
  • d-miner runs XMRig and stops mining when the phone is unlocked.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersSays mining stops when unlocked and lists GhostGrab as a family.
  • Cyber Security NewsNames all seven families, treats GhostGrab as old GhostBat, and notes GitHub takedown and USSD.
Products
Android
Threat actors
CyberDakait
Malware
cyb3rxappkjlgodzd-passived-shineGhostBattenxend-minerGhostGrabXMRig
Organizations
Group-IBSeqriteCybleCYFIRMA
Countries
India

Coverage

oldest first · one row per article · UTC
  1. · 1d ago GBHackersFirst report

    CyberDakait malware hits 17,960 Indian banking Android devices

    Operators intercepted 7,611,443 SMS messages and paired credential theft with XMRig mining on idle phones.

  2. · 1d ago Cyber Security News

    Banking trojans infect 17,960 Android phones in India

    Group-IB says seven families intercepted 7,611,443 SMS messages and stole cards, OTPs, and identity data.