LSPosed Module Bypasses UPI SIM Binding to Enable Payment Account Takeovers
Summary
CloudSek describes the Digital Lutera LSPosed module, which hooks Android telephony APIs, spoofs phone identities and injects fake SMS records to bypass UPI device binding and enable account takeovers. It recommends stronger device attestation and carrier-side SMS验证.
Key points
- The Digital Lutera module uses LSPosed to manipulate Android at runtime, leaving legitimate payment app APKs unmodified and their signatures intact.
- It hooks SMS and telephony APIs to intercept registration tokens, spoof phone numbers, and send data to Telegram.
- Socket.IO C2 commands can inject forged messages into Android’s Sent SMS database to make device binding appear successful.
- The attack requires a rooted attacker-controlled device with LSPosed and a victim device compromised to read, forward, or send SMS messages.
- CloudSek links the module to the actor aliases Berlin and @Syntext_Erorr, and reports more than 500 UPI login messages in one observed group.
- The article recommends enforcing Play Integrity strong-device checks, detecting runtime hooks, and validating registration SMS through carrier-side data.
Article Details
- Attack Vectors
- A rooted device running LSPosed and the Digital Lutera module hooks Android telephony APIs used by legitimate payment apps to intercept outgoing registration SMS messages and spoof the phone number returned to the app.
- The module blocks the original SMS, sends registration tokens to a Telegram bot, and uses Socket.IO commands to insert fabricated SMS records into the device’s Sent database.
- The reported operation also relies on a victim device compromised with a trojanized APK capable of reading, writing, or forwarding SMS messages, including OTPs.
- Defensive Notes
- The article recommends enforcing Google Play Integrity API's MEETS_STRONG_INTEGRITY verdict.
- It recommends runtime hook detection, including checks for LSPosed-related files and unexpected method-call stack traces.
- It recommends carrier-side verification that registration SMS messages traversed the cellular network, rather than relying on a device's local success response or SMS database.
- It recommends moving critical identity, SIM-checking, and SMS-dispatch logic into native code and using out-of-band verification for sensitive steps.
- It recommends scanning for the reported configuration file and module package name, and using strict SSL certificate pinning.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | noob-production[.]up[.]railway[.]app | Reported Socket.IO command-and-control server used to send commands to the malicious module. |
MITRE ATT&CK
Threat Actors
@Berlin_MarketIdentified alongside @Syntext_Erorr as the target actor account; the article also identifies Berlin as the actor's primary alias.@Syntext_ErorrTelegram username embedded in the Digital Lutera module; the article identifies it as an actor account and associates its activity with UPI fraud.BerlinNamed as the primary alias of the actor associated with @Syntext_Erorr and @Berlin_Market; the article attributes Digital Lutera development and UPI fraud services to this actor.
Malware
Vendors
GoogleAPIs rather than the app itself, the payment app’s digital signature remains valid, effectively bypassing Google Play Protect and traditional integrity checks that previously flagged modified binaries. Telegramoutgoing registration tokens, spoof device identities (phone numbers), and exfiltrate 2FA data to Telegram. Crucially, the module uses Socket.IO for real-time Command & Control (C2), allowing attackers to
Products
Androidthreat actors to hijack legitimate, unmodified payment applications by "gaslighting" the underlying Android operating system. Because the malicious module ( the one we analyzed was named ‘Digital Lutera’) hooksAxis MobileTarget App: Axis Mobile (com.axis.mobile).LSPosedshifting from Application Modification (repacking APKs) to Runtime Environment Manipulation via the LSPosed framework. This new attack vector allows threat actors to hijack legitimate, unmodified paymentPaytmEnvironment Setup: The fraudster uses a rooted device with LSPosed installed. They install the "Digital Lutera" module and the legitimate, unmodified payment app (e.g., Paytm, PhonePe).PhonePeEnvironment Setup: The fraudster uses a rooted device with LSPosed installed. They install the "Digital Lutera" module and the legitimate, unmodified payment app (e.g., Paytm, PhonePe).Play Integrity APIthis risk, financial institutions must move beyond basic root detection and implement Google’s Play Integrity API with a strict MEETS_STRONG_INTEGRITY requirement to ensure the bootloader is locked and the OS isUPIAt the core of this methodology is the systematic dismantling of UPI SIM-binding, the primary security pillar of the Indian financial ecosystem. By hooking SmsManager and TelephonyManager, threat actors intercept