CloudSEK exposes "MR ROBOT" malware kit spreading fake bank and Aadhaar apps via messaging links
The security firm CloudSEK published research on 28 October 2026 on "MR ROBOT", an Android malware-as-a-service operation aimed at customers of Indian banks. CloudSEK says affiliates use a Telegram bot called "APK Shi…
- First reported
- Reports
- 1
Source: cloudsek.com · published
What happened
The security firm CloudSEK published research on 28 October 2026 on "MR ROBOT", an Android malware-as-a-service operation aimed at customers of Indian banks. CloudSEK says affiliates use a Telegram bot called "APK Shield" and a web control panel to build personalised banking trojans. The banks and other organisations whose themes are used as bait are impersonated and are not accused. CloudSEK also reports that the data from one affiliate included thousands of intercepted SMS messages from roughly 150 infected phones.
How the scam works
The malware is spread through fake Play-Store-style pages and lures sent through messaging apps. CloudSEK lists themes such as an "Aadhaar update" or KYC check, a bank notice, a utility bill, a telecom recharge and a traffic fine (RTO). The victim is told to install an app from a link, outside the official store. Once it is installed, the app intercepts text messages and one-time passwords, and silently turns on call forwarding using a dialling code of the form *21*number#, so calls to the victim's phone can be diverted to the attackers. It then shows fake overlay screens that collect card details, PINs, UPI data, Aadhaar and PAN numbers and net-banking logins.
The stolen data is sent to a Firebase database and to Telegram. Firebase, Telegram and Cloudflare, which hosts the control panel, are abused here and are not accused. Because the attackers can read the victim's messages and receive their calls, they can pass bank verification while the owner of the phone knows nothing about it. The model is "as a service": the operator supplies the tools and affiliates run their own campaigns, which is why several variants circulate.
CloudSEK's advice is to avoid installing bank or Aadhaar apps from SMS, WhatsApp or Telegram links. It also notes that dialling ##21# cancels call forwarding if it has been switched on without your knowledge.
Source
CloudSEK, "Inside MR ROBOT: malware-as-a-service targeting Indian bank customers", 28 October 2026.
Red flags
- A message or call telling you to install a bank, Aadhaar, KYC, bill or recharge app from a link.
- An APK or a fake Play-Store-style page instead of the real store.
- An app that asks for permission to read and send SMS messages.
- Call forwarding turned on that you did not set up.
- Bank alerts or OTPs for transactions you did not make.
If you were targeted
- 1Install apps only from the official store, by the publisher's name, never from message links.
- 2Deny SMS permissions to any app that has no reason to read your messages.
- 3Dial ##21# to cancel unexpected call forwarding, then uninstall the app and run a security scan.
- 4Call your bank from an official number, block cards and change online-banking passwords.
- 5Report on cybercrime.gov.in or call helpline 1930.