InfoSecBulletin Cybersecurity for mankind
A harmful Android app has been found that pretends to be real Indian banking apps to steal credentials, spy on users, and carry out unauthorized transactions. It uses Firebase for command-and-control operations to deploy phishing pages that look like real banking interfaces, deceiving users into sharing sensitive information.
Static analysis of the dropper reveals permissions such as ACCESS_NETWORK_STATE for monitoring connectivity to facilitate stealthy data exfiltration, REQUEST_INSTALL_PACKAGES for prompting installations of secondary APKs without user awareness, and QUERY_ALL_PACKAGES for profiling installed apps to target banking software specifically.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Permissions of a Dropper
The dropper secretly downloads a hidden file, saves it to external storage, and starts installation without regular app store checks, similar to methods used by advanced banking Trojans.
Delving deeper, the main payload requests permissions like READ_SMS, SEND_SMS, and RECEIVE_SMS to intercept and exfiltrate one-time passwords (OTPs) and two-factor authentication (2FA) codes, while REQUEST_IGNORE_BATTERY_OPTIMIZATIONS ensures uninterrupted background execution.
Permissions like READ_PHONE_STATE and READ_PHONE_NUMBERS allow device fingerprinting and SIM data extraction, including carrier names and phone numbers. They can also enable call forwarding abuse through USSD codes such as **21*number# to redirect calls to numbers controlled by attackers.
The payload disguises itself in the app launcher as INFO, operates silently without an icon, and uses modules like Account for credential theft, Debit for card data theft (validating CVV as 3 digits, card numbers as 19 characters, and ATM PINs as 4 digits), and AutostartHelper for persistence at boot using RECEIVE_BOOT_COMPLETED.
Data exfiltration happens via Firebase Realtime Database, which stores user IDs and intercepted SMS metadata, including sender, content, timestamp, and SIM slot in paths like user/<userID>. Local SharedPreferences also keep key-value pairs for offline storage.
Dynamic analysis shows the dropper initiating with fake update popups to lure users into enabling ‘Install Unknown Apps,’ followed by the payload requesting SMS access and displaying phishing pages that enforce input validation (e.g., 10-digit phone numbers and 4-digit MPINs) to appear legitimate.
Firebase Cloud Messaging (FCM) allows remote command execution, including unauthorized access and real-time SMS tracking, using embedded keys for sender ID, API, and storage buckets for covert control.
During the probe, the Firebase instance remained active but authentication-locked, underscoring its ongoing malicious use.
The malware seen since April 3, 2025, shows trends in mobile financial fraud. Cybercriminals replicate app icons and interfaces to trick users into giving risky permissions, allowing them to steal OTPs and bypass 2FA. Full report here.
CIRT alerts CII, Energy Sectors, Banks risk for a large-scale cyberattack
