CERT-In Reports Android Malware Campaign Using Fake eChallan Alerts
Summary
CERT-In reported an Android campaign using fake eChallan SMS alerts to distribute malicious APKs. The payloads seek sensitive permissions and may use VPN access, while fake challan and banking pages harvest financial data.
Key points
- CERT-In reported a coordinated campaign using fake eChallan and RTO Challan SMS alerts to target Indian users.
- APK files posing as challan or Parivahan apps act as droppers; the article says hidden payloads activate after users tap an “Install Update” prompt.
- The payloads request access to SMS, calls and background activity; in some cases, they also request VPN access that can enable traffic monitoring or interception.
- Fake challan and banking pages are used to collect card details and login credentials. The article says these pages bypass legitimate payment gateways.
- A related browser-based phishing chain uses SMS links to lead users through cloned portals and fabricated challans to fake card-payment pages; the article reports that testing accepted invalid card entries.
- Investigations identified more than 36 RTO-related phishing domains on one server, alongside infrastructure impersonating Parivahan, logistics services and financial institutions.
Article Details
- Event Type
- Android malware and phishing campaign using fake eChallan and RTO Challan alerts to target Indian users.
- Impact
- CERT-In reported that the campaign uses malicious APK droppers and phishing pages to obtain sensitive personal and financial information. The malware can request SMS, call, background activity, and VPN permissions, potentially enabling persistence and traffic interception. Fake payment pages collect card details and login credentials; the article also reports that invalid card entries were accepted during testing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | parizvaihen[.]icu | Deceptive domain reported as mimicking Parivahan services in the phishing operation. |
| IPV4 | 101[.]33[.]78[.]145 | IP address hosting phishing domains that redirect users to fake eChallan portals. |
| IPV4 | 43[.]130[.]12[.]41 | IP address reported to host deceptive domains impersonating Parivahan services. |