MR ROBOT Malware-as-a-Service Targets Indian Bank Customers

A new Android malware-as-a-service (MaaS) operation has been found renting customized banking trojans to criminals targeting Indian bank customers, with one affiliate intercepting 5407 text messages from 153 infected devices.

The operation, branded MR ROBOT by its operators, was detailed in research published on October 28 by threat intelligence firm CloudSEK. Its researchers found an operator control panel, a Telegram-based storefront and a malware builder that let affiliates create bank-themed Android trojans on demand.

The lures are distributed through fake Play Store-style pages and messaging-app links, and impersonate banks as well as utility providers and government services.

MR ROBOT Turns Banking Malware into Subscription Service

CloudSEK said MR ROBOT is not a single actor’s campaign but a multi-tenant crimeware platform. Each affiliate receives its own application ID and can generate Android packages impersonating specific Indian banks.

The platform supports a tiered reseller model with sub-admin accounts, and licenses access for set periods through a control panel identified as version 7.0.

The malware intercepts text messages carrying one-time passwords (OTPs), shows fake screens to harvest banking credentials, card details, PINs and identity information, and can silently enable call forwarding. CloudSEK said this reroutes incoming calls, including banks’ fraud-check callbacks, to a number the attackers’ control.

The storefront, a Telegram bot called APK Shield, offered around 36 lure apps, including bank impersonations and fake apps for utility bills, telecom services, traffic fines and government services.

One Affiliate Intercepted More Than 5400 Text Messages

CloudSEK tracked two affiliates. One affiliate’s panel held around 154 enrolled devices and approximately 3270 intercepted messages, while an exposed Firebase database linked to a second held 153 devices and 5407 messages.

That data was collected between July 16 and 30, 2026, and around 4000 of the messages came from bank and telecommunications short codes. CloudSEK said call forwarding was active on 58% of the devices.

Each build receives a fresh signing certificate and can hide from the Android launcher after installation. CloudSEK said MR ROBOT shares call forwarding and per-customer builders with FatBoyPanel and RedWing , operations previously documented by Zimperium, but its kit, storefront and panel had not been publicly reported.

CloudSEK advised users never to install bank-branded apps from links sent by text, WhatsApp or Telegram, and urged banks to move customers from text-message OTPs toward app-based or Fast Identity Online (FIDO) authentication where feasible.