Hackers have compromised at least 17,960 Android devices and intercepted more than 7.6 million SMS messages in a banking malware campaign targeting India.

The operation combines fake bank calls, phishing websites, malicious applications, and cryptocurrency mining to steal financial information while quietly exploiting infected phones.

The attackers impersonated 11 Indian banking institutions and two government programs, collecting banking credentials, credit card details, and identity documents.

Stolen messages included one-time passwords, transaction alerts, and account communications, giving criminals information that could support unauthorized transactions and further fraud against affected customers.

Researchers from Group-IB identified seven Android Trojan families within the campaign, which they track under the financially motivated CyberDakait threat cluster.

Their technical investigation, published on October 28, 2026, describes activity targeting India’s financial services sector since July 2025, alongside related victim reports dating to January 2025.

Hackers Infect 17,960 Android Phones With Banking Trojans

The victim count comes from two investigated data theft channels. Analysts identified 2,364 unique devices through installation notifications and another 15,596 through exposed Firebase infrastructure.

Similar risks appeared in earlier Android banking credential theft campaigns involving Ajina, although that operation targeted different markets and should not be confused with CyberDakait.

Example of a public victim’s post about a CPP fraud scheme (Source - Group-IB) — Example of a public victim’s post about a CPP fraud scheme (Source – Group-IB)

Investigators counted exactly 7,611,443 intercepted messages across the campaign. The malware forwarded incoming SMS content to attacker-controlled Telegram bots and Firebase systems in near real time.

Researchers also found stolen card numbers, expiration dates, CVV codes, card grid values, PAN details, Aadhaar numbers, and other personal information. The scam often begins with a phone call shortly after someone receives a new credit card.

A caller posing as a bank employee claims that a “Credit Card Protection Plan” has been activated and will generate charges unless cancelled. The victim receives a link, sometimes through WhatsApp, supposedly needed to complete that cancellation.

Bank-themed phishing pages then direct visitors toward malicious Android APK files hosted in GitHub repositories. Once installed, the initial application displays a fake Google Play update page while delivering another application.

Requests to disable battery optimization help the malware remain active despite Android’s background restrictions. The fake cancellation process gradually requests card details, internet banking credentials, identity information, and photographs.

This staged approach makes each request appear connected to account verification. It also gives attackers more than passwords: they obtain supporting personal information that can strengthen later impersonation attempts against the same victims.

Seven Malware Families Combine SMS Theft With Remote Control

Group-IB classified the samples as cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat, and tenxen. Researchers determined that GhostGrab, previously covered for its banking login theft capabilities, represents an older version of GhostBat rather than an eighth family.

Shared phishing themes alone were insufficient to classify every sample as one malware strain. The families differ in network traffic, database structures, message formats, and command handling.

d-miner infection chain (Source - Group-IB) — d-miner infection chain (Source – Group-IB)

Their common capabilities include SMS interception, message forwarding, call forwarding, and financial data theft through deceptive interfaces. Some communicate through Telegram, others use Firebase, and others send stolen information to remote web servers.

A separate discovery exposed an administrative Android application used to manage cyb3rx infections. Its interface allowed operators to inspect intercepted messages, retrieve phishing data, manage devices, and issue commands.

Supported actions included sending SMS messages, changing forwarding settings, activating call forwarding, and executing custom USSD requests.

The infection chain also includes d-miner, which uses XMRig to mine cryptocurrency without permission. That combination reflects the broader danger of Android malware delivery frameworks, where an initial application can introduce additional threats.

Group-IB observed wake locks, silent audio playback, and foreground services helping the mining component continue operating.

Researchers also found evidence that GhostBat developers used Android phones to write and compile malware. However, the report does not establish that every related Trojan belongs to one operator.

CyberDakait is an analytical cluster linking shared campaign behavior, while differences between families remain important for detection and investigation.

Group-IB reported the identified GitHub accounts and repositories, which were subsequently deactivated. Users should reject banking applications delivered through unsolicited links, verify unexpected calls using official bank contact details, and review SMS permissions carefully.

Anyone suspecting compromise should immediately contact their bank to freeze exposed accounts and prevent further unauthorized activity.

Indicators of compromise (IoCs):-

Indicator type	Source-listed values
Phishing domains	`81service[.]icu` `81service[.]in` `Imanagec[.]online` `applypointguides[.]in` `cancelcardprotection[.]online` `cancelcpservice[.]in` `cancelmyservice[.]in` `cancelservice[.]in` `cardforex[.]icu` `cardplan[.]online` `cardprotections[.]in` `cardsprotection[.]in` `cardsprotection[.]online` `careidf[.]online` `carep[.]online` `cpmanaged[.]in` `cppmanage[.]in` `deactivatecpplan[.]in` `deactivatecpservice[.]in` `hamzaansari1612-ux[.]github[.]io` `hdmanage[.]online` `icppuser[.]in` `icppuser[.]online` `icservice[.]online` `icuser[.]online` `idcare[.]in` `idfcare[.]in` `idmanagecp[.]online` `idservice[.]in`
Phishing domains, continued	`imobile[.]services` `imobilelite[.]in` `imobileservices[.]online` `indeemanage[.]in` `indemanage[.]in` `indiuser[.]com` `inducare[.]online` `managebworld[.]com` `managecare[.]in` `managecare[.]online` `managecp[.]co[.]in` `managecp[.]com` `manageici[.]com` `manageinsurances[.]online` `manageprotection[.]in` `manageprotectionplan[.]in` `manageprotections[.]com` `myicuser[.]in` `myinsuranceservice[.]in` `mypnhelp[.]online` `mypolicyservice[.]in` `pmanage[.]online` `pncare[.]online` `policydeactivate[.]in` `protectcc[.]online` `protectionmanage[.]online` `rohansingh253641-spec[.]github[.]io` `secureici[.]online` `servicecpp[.]in` `serviceic[.]in` `serviceici[.]in` `serviceidf[.]in` `serviceidf[.]online` `servicescard[.]online` `serviceshelp[.]online` `suraj527526-cmyk[.]github[.]io` `www.icppuser[.]online` `www.icuser[.]online` `www.protectcc[.]online` `www.secureici[.]online` `www.servicecpp[.]com` `www.serviceic[.]com`
C2 addresses and associated infrastructure	`64.89.163[.]3` `78.159.156[.]74` `144.31.244[.]184` `46.151.182[.]28` `ws://64.89[.]163.3:8082` `64.89.163[.]4` `aptabase[.]fud2026.xyz:8443` `accessor[.]fud2026.com` `fud2026[.]com` `pool.fud2026[.]com:9000` `pool-proxy.fud2026[.]com:9000` `install-update[.]xyz` `app2-update2[.]site` `update-app[.]online`
Controller API examples	`hXXp://64.89[.]163.3/idfc/1/api/` `hXXp://64.89[.]163.3/pnb/1/api/`
Malicious GitHub accounts and repository paths	`muhaamad852-netizen` `gopalmalo36374-beep` `rahul3555899-prog` `asdg18982-netizen` `ranidevisingh901-debug` `arushkumar8012-hub` `dapu72979-png/bdtch` `ks3232896-web/endyyee` `uchianawitachizon-prog` `cybercodex34-glitch` `nobitaxnobi00-dotcom` `ankit2560777-gif` `sanishaw308-sudo` `DeactiveCpp4u` `malikchikku11-web` `t2118417-max`
Administrative controller repository	`ranidevisingh901-debug/gsafsdfsdf`

The report lists the following APK SHA-256 hashes for sample matching and investigation.

Source family label	SHA-256
cyberx	`0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856`
cyberx	`1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624`
cyberx	`2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f`
cyberx	`3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921`
cyberx	`5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4`
cyberx	`5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456`
cyberx	`7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d`
cyberx	`47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112beca186d844a`
cyberx	`65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68`
cyberx	`80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a`
cyberx	`431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa`
cyberx	`902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b`
cyberx	`b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9`
cyberx	`b332fa9c08020fbbc5503091b4f4a61ee66a05a0a76abf9a53db9f3d80c4862a`
cyberx	`c9ead89d1bcb09923e1057bb4617726867154d36932ed1c2f82c2466bf11934c`
cyberx	`c36d2b4480034a409f33cdef8d7c3501e75f14d2c5bd9a914a65fd7f3c47d74a`
cyberx	`c6708166e0a6bf3484200fd6dd1569d89e81c36ffd76ff2ab5820b06fd2d5b54`
cyberx	`cb86017411708eb6e5384fc0288b0ec4692ea45ef38586b7c67f99148e1117c3`
cyberx	`cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7`
cyberx	`cf66a1acebd878d85345377be53ac0b241f517253811ec969c8ff9c751151424`
cyberx	`dfa02773f97f552deb7ff04f5c598a81be4d236fe33adca2a47551485a3aeb2a`
godz	`9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8`
godz	`1b9052d85e12573b4f64f6a47f64803007b19990def1bc62a865de00149a825e`
godz	`5c0f8bca492c9ee79d6bbd7a532945514670321a605002987f69e3331110e447`
godz	`53f9fcf3a6fdc59e9a28fd129a32064d78628289eac72d47f53d63cbc434de41`
ghostbat	`43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6`
ghostbat	`34b75b78b6c575c8a9e71f712be9d90aa35a3a04b48839f86282678107f7876d`
d-passive.ExampleAdmin	`1bfaaa9aed67552a2c368df3f264ef6878a4e7b43468546db77f095517b15b56`
d-passive.TradeSignals	`04b35b0c199ef8a13d6ac18dfc6df2ea66a8ed5b6e464dc3a7db0839093882bd`
tenxen	`d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f`
tenxen	`4a17171155997754ad735b460be67e344c5939d9cff498ce1d95bf554b93fc1b`
d-shine	`3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc`
appkjl	`555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd1bdeb843570f`

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Infect 17,960 Android Phones With Banking Trojans, Steal 7.6 Million SMS Messages appeared first on Cyber Security News.