MR ROBOT Android MaaS Uses SMS Theft and Call Forwarding to Target Indian Bank Customers
Summary
CloudSek traces MR ROBOT, an Android MaaS operation targeting Indian bank customers, and details its custom trojans, SMS/OTP and credential theft, silent call forwarding, Firebase/Telegram exfiltration, and affiliate control panel.
Key points
- CloudSek reports that MR ROBOT is a rented, multi-tenant Android crimeware platform, with affiliates using an APK builder and Telegram bot to create bank- and service-themed lures.
- Analyzed trojans intercept SMS and OTPs, silently enable *21# call forwarding, and use phishing overlays to collect financial and identity credentials.
- The dropper decrypts and installs a second-stage trojan; CloudSek describes emulator checks, a 48-hour and three-launch dormancy gate, and per-build signing certificates as evasion measures.
- CloudSek found the same Firebase configuration in trojans built for different lures, indicating that one affiliate's catalog can send data to a shared backend.
- The reported telemetry comes from separate tenants: Affiliate A's panel showed about 154 devices and 3,270 messages; Affiliate B's exposed database contained 153 devices and 5,407 SMS.
- The operation's panel and storefront support per-affiliate licensing, reseller tiers, and on-demand personalized APK builds; CloudSek says the panel was at version 7.0.
- CloudSek recommends customers avoid installing bank or Aadhaar-update APKs from messaging links, review SMS and call permissions, and advises banks to address call forwarding and move beyond SMS-based OTP where feasible.
Article Details
- Attack Vectors
- Social-engineering links distributed through messaging apps lead to fake Play-Store-style pages offering bank-branded, Aadhaar/KYC, utility, or government-service APKs for sideloading.
- An outer APK dropper decrypts an AES-encrypted second-stage payload and installs the inner banking trojan under a randomized package name.
- The trojan intercepts incoming SMS messages, including OTPs, and can send or delete SMS messages.
- HTML phishing overlays collect Aadhaar, PAN, card details, CVV, ATM PIN, UPI PIN, and net-banking credentials.
- The malware silently enables unconditional *21# call forwarding to redirect bank callbacks to a mule number.
- Stolen SMS and credentials are sent to an affiliate-specific Firebase Realtime Database and a Telegram channel.
- Evasion measures include emulator checks, a delay requiring several launches and at least 48 hours, no post-install launcher icon, a local-VPN black-hole service, and per-build randomized signing certificates.
- Defensive Notes
- For customers reporting missed calls or an unexpected Aadhaar/KYC app installation, treat SMS OTPs as potentially compromised and advise dialing ##21# to cancel call forwarding.
- Where feasible, migrate from SMS OTP to app-based or FIDO authentication.
- Monitor the listed indicators and hunt for the identified package names and certificates.
- Advise users not to install bank or Aadhaar-update APKs from SMS, WhatsApp, or Telegram links; keep Google Play Protect enabled and review apps with SMS and call permissions.
- Report abuse to the relevant infrastructure providers and CERT-In; the article identifies disabling an affiliate's Firebase project as a way to disrupt that affiliate's catalog.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | baccha-a07d9-default-rtdb[.]firebaseio[.]com | Firebase Realtime Database C2 shared across an affiliate's catalog of trojans. |
| DOMAIN | mr-panel-bbv[.]pages[.]dev | Live hostname serving the MR ROBOT web control panel. |
| DOMAIN | mr-panel[.]pages[.]dev | Offline hostname hardcoded in the operator console for the MR ROBOT control panel. |
| SHA256 | 8b8e44431aff7fcf38f67ac30d4c63250e51117861635a8510ea1c897df49488 | SHA-256 of an example builder-produced APK identified as a bank-lure dropper. |
| SHA256 | ccd0bb059c9da0afb433effebc3c9ed76751569f5abcd1b34d7fc3dab87fd74b | SHA-256 fingerprint of the signing certificate for the victim dropper associated with the Aadhaar-update lure. |
| SHA256 | fde290df3f3575e8359044d5489e67ff189132b9d73f4ff90cf33d297eb65a4f | SHA-256 fingerprint of the signing certificate for the MR_ROBOT operator-console APK. |
MITRE ATT&CK
T1398The inner trojan requests RECEIVE_BOOT_COMPLETED to relaunch after reboot.T1406The dropper uses AES-encrypted payloads, XOR-obfuscated loader strings, and a fake-ZIP-encryption anti-analysis trick.T1407The dropper decrypts and dynamically loads a bootstrap DEX and inner APK.T1417.002HTML phishing overlays capture financial and identity data entered by victims.T1437.001The trojan communicates with Firebase Realtime Database over HTTPS.T1521The article reports TLS-protected communications with Firebase and Telegram.T1582The trojan can send and delete SMS messages on the device.T1616The malware silently enables *21# call forwarding to redirect incoming bank callbacks.T1629The trojan includes a local-VPN black-hole service that filters traffic.T1633.001The dropper checks device fingerprint, model, hardware, and carrier, and delays execution until several launches and at least 48 hours have passed.T1636.004A high-priority SMS receiver captures incoming messages, including bank OTPs.T1646Stolen SMS and credentials are exfiltrated to Firebase Realtime Database and Telegram.T1655The APKs impersonate banks, Aadhaar/KYC services, utilities, and RTO services.T1660Telegram, WhatsApp, and SMS lures direct victims to fake Play-Store-style pages distributing APKs.
Vendors
Products
AndroidMR ROBOT is a previously unreported Android Malware-as-a-Service (MaaS) operation targeting customers of Indian banks. It is not a single-actor campaign but a rented crimeware platform: a master operator leases accessMR ROBOTMR ROBOT is a previously unreported Android Malware-as-a-Service (MaaS) operation targeting customers of Indian banks. It is not a single-actor campaign but a rented crimeware platform: a master operator leases access