InfoSecBulletin Cybersecurity for mankind
A harmful Android app has been found that pretends to be real Indian banking apps to steal credentials, spy on users, and carry out unauthorized transactions. It uses Firebase for command-and-control operations to deploy phishing pages that look like real banking interfaces, deceiving users into sharing sensitive information.
Static analysis of the dropper reveals permissions such as ACCESS_NETWORK_STATE for monitoring connectivity to facilitate stealthy data exfiltration, REQUEST_INSTALL_PACKAGES for prompting installations of secondary APKs without user awareness, and QUERY_ALL_PACKAGES for profiling installed apps to target banking software specifically.
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Permissions of a Dropper
The dropper secretly downloads a hidden file, saves it to external storage, and starts installation without regular app store checks, similar to methods used by advanced banking Trojans.
Delving deeper, the main payload requests permissions like READ_SMS, SEND_SMS, and RECEIVE_SMS to intercept and exfiltrate one-time passwords (OTPs) and two-factor authentication (2FA) codes, while REQUEST_IGNORE_BATTERY_OPTIMIZATIONS ensures uninterrupted background execution.
Permissions like READ_PHONE_STATE and READ_PHONE_NUMBERS allow device fingerprinting and SIM data extraction, including carrier names and phone numbers. They can also enable call forwarding abuse through USSD codes such as **21*number# to redirect calls to numbers controlled by attackers.
The payload disguises itself in the app launcher as INFO, operates silently without an icon, and uses modules like Account for credential theft, Debit for card data theft (validating CVV as 3 digits, card numbers as 19 characters, and ATM PINs as 4 digits), and AutostartHelper for persistence at boot using RECEIVE_BOOT_COMPLETED.
Data exfiltration happens via Firebase Realtime Database, which stores user IDs and intercepted SMS metadata, including sender, content, timestamp, and SIM slot in paths like user/<userID>. Local SharedPreferences also keep key-value pairs for offline storage.
Dynamic analysis shows the dropper initiating with fake update popups to lure users into enabling ‘Install Unknown Apps,’ followed by the payload requesting SMS access and displaying phishing pages that enforce input validation (e.g., 10-digit phone numbers and 4-digit MPINs) to appear legitimate.
Firebase Cloud Messaging (FCM) allows remote command execution, including unauthorized access and real-time SMS tracking, using embedded keys for sender ID, API, and storage buckets for covert control.
During the probe, the Firebase instance remained active but authentication-locked, underscoring its ongoing malicious use.
The malware seen since April 3, 2025, shows trends in mobile financial fraud. Cybercriminals replicate app icons and interfaces to trick users into giving risky permissions, allowing them to steal OTPs and bypass 2FA. Full report here.
CIRT alerts CII, Energy Sectors, Banks risk for a large-scale cyberattack
