Group-IB: "Card Protection Plan" calls and WhatsApp links push Android trojans on Indian bank customers
Group-IB's threat-intelligence team published research on 28 October 2026 on an Android malware campaign that has targeted India's financial sector since July 2025. Group-IB tracks the malware operator as "CyberDakait…
- First reported
- Reports
- 1
Source: group-ib.com · published
What happened
Group-IB's threat-intelligence team published research on 28 October 2026 on an Android malware campaign that has targeted India's financial sector since July 2025. Group-IB tracks the malware operator as "CyberDakait". The research describes a scam in which people receive a call about a "Credit Card Protection Plan" (CPP), usually soon after getting a new card. The caller poses as a bank representative and says the plan has been activated automatically, with charges of roughly $5 to $150, unless it is cancelled at once. The banks are impersonated and are not accused.
How the scam works
To "cancel" the plan, the caller sends a link, often on WhatsApp, to a bank-themed phishing page. Pressing any button on the page silently downloads an Android app from a GitHub-hosted repository. The app shows a fake Google Play update screen while it installs a different program in the background, then asks to turn off battery optimisation so that it can keep running. GitHub is abused here and is not accused.
The page then walks the victim through four steps: card number, expiry date and CVV; net-banking login and the grid numbers on the back of the card, described as KYC; the registered mobile number, PAN and date of birth; and a photo of the front of the card. Each step looks like routine verification, but together they give the attackers everything needed to take over the card and the identity.
Group-IB identified seven malware families used in the campaign. They impersonate eleven Indian banks and two government programmes. It found at least 17,960 compromised devices across all channels and about 7.6 million intercepted SMS messages, which lets the operators capture one-time passwords. Group-IB says the phone-call scheme has run since at least January 2025 and that no specific group has been formally attributed for the calls.
Source
Group-IB Threat Intelligence, research on the CyberDakait Android malware campaign targeting India, 28 October 2026.
Red flags
- A call about a "Card Protection Plan" you never signed up for, shortly after a new card arrives.
- Threats of charges of up to about $150 unless you act immediately.
- A link sent on WhatsApp to cancel the plan, leading to a bank-looking page.
- A page that downloads an app without asking, or fakes a Google Play update.
- Requests for CVV, net-banking login, PAN and a photo of your card.
If you were targeted
- 1Hang up and call your bank on the number printed on your card or its official website.
- 2Never install an app from a link sent by a caller or in a chat.
- 3Never share your CVV, grid numbers or one-time codes with anyone.
- 4If you installed an app, uninstall it, run a scan and ask your bank to block the card.
- 5Report on cybercrime.gov.in or call 1930.