Group-IB ties seven Android trojan families to Indian banking fraud campaign

Group-IB's Threat Intelligence team published an analysis on October 28, 2026, describing an Android malware campaign aimed at India's financial services sector. The researchers track the financially motivated cluster as CyberDakait and say the operation has been systematically targeting the sector since July 2025.

The campaign uses coordinated smishing and vishing. Callers pose as bank representatives and tell victims a "Credit Card Protection Plan" has been activated automatically, with charges they must cancel immediately. Victims are then sent to phishing pages that prompt them to install an APK. Group-IB says the malicious apps are commonly hosted on GitHub to look legitimate, and that the initial APK works as a dropper for a main payload and a cryptocurrency mining module.

The samples span seven malware families, each with its own command-and-control and exfiltration setup, including Firebase, Telegram bots and a remote backend. Group-IB reports that 11 Indian banking institutions and 2 government programs were impersonated, and that the apps request mobile banking login credentials, credit card details including front and back photos, and outstanding balances.

Group-IB says it identified at least 17,960 compromised devices across all exfiltration channels and 7.6 million SMS messages intercepted from victim devices. It also found a GitHub repository hosting an administrative controller APK used to track victims and issue commands.

For defenders, the report points to app-install behavior as the choke point: users should treat unsolicited calls about card protection plans as a reason to contact the bank through official channels, and organizations should watch for sideloaded APKs on managed devices.