KYCShadow Android Malware Uses Fake KYC Workflows to Steal Credentials and OTPs

Apr 24, 2026 · Original article ↗

Summary

Cyfirma analyzes KYCShadow, an Android malware campaign distributed via WhatsApp. Its hidden payload uses fake KYC screens, SMS and call control, and a VPN; the report links its infrastructure to earlier e-Challan fraud with moderate-to-high confidence.

Key points

A WhatsApp-distributed dropper uses a fake update flow to install the concealed secondary payload com.am5maw3.android.
The dropper decrypts an embedded APK using XOR and installs it through Android's PackageInstaller.
A Capacitor WebView presents staged KYC phishing screens seeking mobile and ATM PINs, Aadhaar details, and card credentials.
Firebase Cloud Messaging commands support SMS interception and forwarding, inbox collection, remote SMS and calls, and USSD operations.
A full-tunnel VPN routes device traffic through the app, while battery-exemption requests and launcher hiding help maintain concealment.
The report says the malware encrypts collected data before sending it to hxxps://jsonapi[.]biz; native library code conceals the endpoint and configuration.
Shared infrastructure naming and e-Challan-themed phishing artifacts support the report's moderate-to-high-confidence hypothesis of a link to earlier RTO e-Challan fraud operations.

Article Details

Attack Vectors: The dropper is distributed via WhatsApp using a fake update and banking KYC workflow to induce APK installation.
The dropper XOR-decrypts an embedded APK and installs the secondary payload through a PackageInstaller session; the payload is hidden from the launcher.
A staged WebView phishing flow requests mobile and ATM PIN details, Aadhaar and date of birth, and payment-card information.
Firebase Cloud Messaging delivers commands for SMS interception and forwarding, inbox extraction, remote SMS sending, calls, and USSD operations.
A custom full-tunnel VPN routes device traffic through an application-controlled layer for monitoring and potential filtering.
The malware encrypts collected data locally and sends it to its C2 server using HTTP POST.
Defensive Notes: Block and monitor jsonapi[.]biz, jsonserv[.]biz, and jsonserv[.]xyz in network security and DNS-filtering controls.
Monitor for fake update prompts, VPN activation requests, silent APK installation, hidden applications, and unusual SMS, USSD, or call-forwarding activity.
Warn users not to install APKs delivered through messaging platforms or enter OTPs, PINs, CVVs, or banking credentials into unverified applications.
Keep installation of unknown apps disabled and review unexpected VPNs, installed applications, and call-forwarding settings.
Use transaction monitoring and step-up authentication for suspicious activity, including unusual OTP requests, SIM changes, or unfamiliar devices.
Analyze suspicious applications statically and dynamically, including native libraries that may conceal configuration and C2 values.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`jsonapi[.]biz`	Current campaign C2 domain used for encrypted HTTP POST exfiltration and backend communication.
DOMAIN	`jsonserv[.]biz`	Domain identified as C2 infrastructure associated with the earlier RTO e-Challan fraud operation linked in the report.
DOMAIN	`jsonserv[.]xyz`	Domain identified as C2 infrastructure associated with the earlier RTO e-Challan fraud operation linked in the report.
SHA256	`1d261b45e73b5b712becb12ed182ec89d3dd0d73143a2dd8ff5512da489a50eb`	SHA-256 hash identified for the dropped APK payload.
SHA256	`34479b18597f1a0deb5d55b8450bc21af1d1f638c4ceca1ee19e6f5ac89d6be2`	SHA-256 hash identified for the KYCShadow dropper APK.