MR ROBOT Malware-as-a-Service Targets Indian Bank Customers

• •MR ROBOT is a multi-tenant Malware-as-a-Service targeting Indian banks.
• •The malware intercepts OTPs and can silently enable call forwarding.
• •CloudSEK tracked two affiliates with significant message interception activity.

MR ROBOT is a newly discovered Android Malware-as-a-Service (MaaS) operation targeting Indian bank customers. It allows affiliates to create customized banking trojans using a control panel and a Telegram bot called APK Shield. The malware can intercept SMS messages containing one-time passwords (OTPs), enable call forwarding to redirect bank communications, and harvest sensitive information such as banking credentials. The operation has been linked to two affiliates, one of which intercepted over 5,400 messages from 153 devices. The malware is distributed through fake Play Store pages and messaging app links. CloudSEK, which reported on this operation, emphasizes the need for banks to shift towards more secure authentication methods. The platform operates on a subscription model, with each affiliate receiving unique application IDs for their trojans. The operation is characterized by its multi-tenant architecture and sophisticated evasion techniques.