New Delhi, Oct 28 (PTI) Cyber security company CloudSEK has discovered a new cyber criminal gang, operating in the name of Mr Robot, which is renting out technical tools to compromise mobile phones of Indian banking customers and siphon off their money.
CloudSEK said in a blog that its researchers have found that Mr Robot has its own admin app and rents out crimeware platforms to many fraudsters to install malicious apps in mobile phones of banking customers.
“CloudSEK researchers began investigating one such app, which impersonated a public-sector bank. It led them to Mr Robot, a previously unreported Android Malware-as-a-Service operation targeting customers of Indian banks,” the company said in a statement.
Cyber fraudsters use the crimeware to install the app and then its icon disappears.
“From that moment, every OTP the customer receives goes to a fraudster’s dashboard. Calls from the bank are silently forwarded to another number,” CloudSEK said.
The malware is designed to avoid detection. It stays dormant for at least 48 hours to get past automated security checks, and each copy carries a new digital signature, so security tools cannot block new versions by matching them to old ones, according to the blog.
The bot’s catalogue holds about 36 lure apps. These include fake apps for nine public- and private-sector banks, gas, water and electricity bill payments, and “RTO Challan” traffic-fine pages that charge a ₹9 to ₹10 “fee” to collect PAN and other personal details.
Once installed, the malware reads incoming SMS to steal OTPs.
It uses the carrier code *21# to forward the victim’s calls to the fraudsters, so verification calls from the bank never reach the customer.
Fake screens collect Aadhaar, PAN, card number, CVV, ATM PIN, UPI PIN and net-banking credentials.
“Data from just two affiliates shows how widely it is being used. One had about 154 infected phones and about 3,270 intercepted messages. The other had left its database exposed. As of 30 July 2026, it held 153 infected phones and 5,407 intercepted SMS messages, with OTPs from more than a dozen banks and payments banks,” the blog said.
CloudSEK researchers found that call forwarding was active on 58 per cent of those victims, and 149 of the phones were infected in a single burst in May.
Most victims used budget Android phones, with SIMs from all four major Indian carriers, the blog said.
