InfoSecBulletin Cybersecurity for mankind
A harmful Android app has been found that pretends to be real Indian banking apps to steal credentials, spy on users, and carry out unauthorized transactions. It uses Firebase for command-and-control operations to deploy phishing pages that look like real banking interfaces, deceiving users into sharing sensitive information.
Static analysis of the dropper reveals permissions such as ACCESS_NETWORK_STATE for monitoring connectivity to facilitate stealthy data exfiltration, REQUEST_INSTALL_PACKAGES for prompting installations of secondary APKs without user awareness, and QUERY_ALL_PACKAGES for profiling installed apps to target banking software specifically.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Permissions of a Dropper
The dropper secretly downloads a hidden file, saves it to external storage, and starts installation without regular app store checks, similar to methods used by advanced banking Trojans.
Delving deeper, the main payload requests permissions like READ_SMS, SEND_SMS, and RECEIVE_SMS to intercept and exfiltrate one-time passwords (OTPs) and two-factor authentication (2FA) codes, while REQUEST_IGNORE_BATTERY_OPTIMIZATIONS ensures uninterrupted background execution.
Permissions like READ_PHONE_STATE and READ_PHONE_NUMBERS allow device fingerprinting and SIM data extraction, including carrier names and phone numbers. They can also enable call forwarding abuse through USSD codes such as **21*number# to redirect calls to numbers controlled by attackers.
The payload disguises itself in the app launcher as INFO, operates silently without an icon, and uses modules like Account for credential theft, Debit for card data theft (validating CVV as 3 digits, card numbers as 19 characters, and ATM PINs as 4 digits), and AutostartHelper for persistence at boot using RECEIVE_BOOT_COMPLETED.
Data exfiltration happens via Firebase Realtime Database, which stores user IDs and intercepted SMS metadata, including sender, content, timestamp, and SIM slot in paths like user/<userID>. Local SharedPreferences also keep key-value pairs for offline storage.
Dynamic analysis shows the dropper initiating with fake update popups to lure users into enabling ‘Install Unknown Apps,’ followed by the payload requesting SMS access and displaying phishing pages that enforce input validation (e.g., 10-digit phone numbers and 4-digit MPINs) to appear legitimate.
Firebase Cloud Messaging (FCM) allows remote command execution, including unauthorized access and real-time SMS tracking, using embedded keys for sender ID, API, and storage buckets for covert control.
During the probe, the Firebase instance remained active but authentication-locked, underscoring its ongoing malicious use.
The malware seen since April 3, 2025, shows trends in mobile financial fraud. Cybercriminals replicate app icons and interfaces to trick users into giving risky permissions, allowing them to steal OTPs and bypass 2FA. Full report here.
CIRT alerts CII, Energy Sectors, Banks risk for a large-scale cyberattack
