Mobile
CyberDakait: 7.6 million SMS stolen from Indian bank users
Group-IB tied seven Android trojan families to 17,960 phones of Indian bank customers. How the SMS theft works and what banks, IT teams and users should change.
Group-IB published research on October 28 into CyberDakait, its name for a financially motivated cluster that spreads Android malware to customers of Indian banks. It sorted the samples into seven trojan families: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat (older builds were called GhostGrab) and tenxen. The lures impersonate 11 Indian banking institutions and 2 government programs. Group-IB counts at least 17,960 infected phones and 7,611,443 intercepted SMS messages, about 7.6 million, including one-time passwords (OTPs) and bank transaction alerts.
The report gives two start dates: July 2025 in its introduction, and at least January 2025 based on earlier victim reports. Either way the campaign has run for well over a year. Anyone in India who banks on an Android phone is in scope, and so is any company whose staff approve payments from personal or managed Android phones. Group-IB treats CyberDakait as an analytical cluster: the families differ technically, and the report does not show that one operator runs them all.
How it works
The usual lure is a phone call about a "Credit Card Protection Plan". The caller poses as bank staff and says the plan will be charged unless the victim cancels it. When the victim asks how, a link arrives, sometimes over WhatsApp. It opens a bank-themed phishing page that delivers an APK (an Android app package) hosted on GitHub.
Once installed, the first app shows a fake Google Play update screen while it installs a second app. It asks the victim to switch off battery optimization so Android does not put it to sleep. Fake forms then collect the card number, expiry date and CVV, internet banking credentials, PAN and Aadhaar numbers, and a photo of the card.
The payment itself is approved with an SMS OTP, and that is where the trojans earn their keep. On Android, permission to receive and read SMS is a runtime permission: one dialog the user taps through. Google Play only lets an app request it if the app is the default SMS, Phone or Assistant handler, apart from a short list of exceptions, but a sideloaded APK never goes through Play review. With that permission, the trojan sees each message as it arrives and forwards it to a Telegram bot, a Firebase database or the operator's web server. The operator now holds the card, the login and the code that approves the payment.
Android 13 added "restricted settings", which by default stops sideloaded apps from turning on Accessibility or notification listener access, the two routes overlay trojans use to read the screen. SMS permission sits outside that block, which helps explain why these families lean on SMS instead.
Most of the families can also forward calls. Group-IB found an admin app for cyb3rx that lets the operator turn on call forwarding and send custom USSD requests. A USSD code is a short dial string such as *21*number#, which tells the carrier to forward every incoming call to another number. Once calls are forwarded, the bank's verification call rings on the attacker's phone.
A separate dropper, d-miner, adds cryptojacking. It runs the XMRig miner on the victim's phone and keeps it alive with wake locks, a silent audio loop and a foreground service.
What attackers are doing
The device count comes from two places. Group-IB identified 2,364 devices through "new app installation" notifications the malware sent to its operators, then found another 15,596 in an exposed Firebase storage channel. The 17,960 total adds the two, and the report does not say whether any device appears in both.
The stolen data goes well beyond OTPs: card numbers, CVVs, full names, dates of birth, PAN and Aadhaar numbers. Punjab National Bank and IDFC First Bank appear among the impersonated brands. The cyb3rx admin app also let operators read intercepted messages, send SMS from the victim's phone and change forwarding rules. The APKs and that admin app were hosted on GitHub, and GitHub deactivated the accounts after Group-IB reported them.
CyberDakait is not the only operation of this kind. On the same day, CloudSEK described MR ROBOT, a malware-as-a-service platform that rents bank-themed Android trojans to affiliates through a Telegram bot called APK Shield. One affiliate's exposed database held 5,407 intercepted SMS from 153 devices up to July 30, 2026, and call forwarding was active on 58% of that affiliate's victims.
What to do
Banks and card issuers
- Stop treating a correct SMS OTP as proof that the customer approved a payment. The Reserve Bank of India's authentication directions, in force since April 1, 2026, still allow SMS OTP as a factor but encourage newer ones and risk-based checks. Move new payees, limit changes and card-not-present payments to in-app approval bound to a registered device, or to passkeys (FIDO2 credentials kept on the phone and unlocked with a fingerprint or PIN).
- Add call forwarding to your risk signals. CloudSEK advises banks to treat SMS OTP as compromised for customers who report missed calls or unexpected "KYC" app installs.
- Tell customers plainly that the bank never sends an APK, never asks for a CVV over the phone, and never cancels a "protection plan" through a link.
IT teams with managed Android phones
- In your mobile device management (MDM) console, apply the
DISALLOW_INSTALL_UNKNOWN_SOURCESrestriction on Android Enterprise devices, so a link in WhatsApp cannot install anything. - Use the runtime permission policy to deny SMS permissions to every app except the default messaging app, and the permitted Accessibility services list to allow only named assistive apps.
- Keep Play Protect on and reporting. In India, Google's enhanced fraud protection blocks installs from browsers, messaging apps and file managers when the APK declares RECEIVE_SMS, READ_SMS, notification listener or Accessibility access.
Users
Hang up on anyone who calls about card charges and call back on the number printed on your card or the bank's website. Install banking apps only from Google Play. Open Settings, Apps, then Permissions, SMS, and remove access from anything that is not your messaging app. If you already installed an app from a link, dial ##21# to cancel call forwarding, ask the bank to freeze cards and internet banking, then reset the phone and change your banking credentials from another device.
Where the weak link sits
Each family here works because a bank still accepts something that arrives over SMS as the final approval. Device-bound in-app approval moves that step somewhere a sideloaded trojan with SMS access cannot read.
Our mobile penetration testing team tests whether your app and backend can be talked into approving a payment with an intercepted OTP, and our security operations team watches managed fleets for unknown installs and permission changes. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Group-IB, GBHackers, Cybersecurity News via Cryptika, CloudSEK, The Pioneer, Google India blog, 9to5Google, Android Authority, Google Play SMS and Call Log policy, The Tribune, ETV Bharat.