CyberDakait Deploys Seven Android Trojan Families Against 17,960 Indian Banking Devices

At a Glance

TL;DR

Group-IB researchers uncovered a large-scale CyberDakait Android malware operation. This attack compromised at least 17,960 mobile devices across India since July 2025. Attackers used fake Credit Card Protection Plan calls and WhatsApp links. Through these, the Indian CyberDakait Android malware cluster distributes seven distinct trojan families alongside a cryptocurrency miner. Across all monitored channels, the attackers intercepted 7,611,443 SMS messages. They also stole banking logins, identity documents, and credit card photos.

Delivery and Attribution

Victim reports show that this fraud scheme has targeted Indian banking customers since at least January 2025. Group-IB has tracked the broader malware campaign since July 2025. Typically, callers contact victims within 24 hours of a new credit card issuance while posing as bank staff. The caller warns that an automatic Credit Card Protection Plan will charge between $5 and $150 unless the user cancels it immediately. Next, the scammer sends a WhatsApp or SMS link pointing to a bank-themed phishing page impersonating one of 11 Indian banks or two government programs. Clicking any button on the page triggers an automatic download of a malicious APK hosted on GitHub. Group-IB reported all identified repositories to GitHub. Hence, GitHub deactivated the accounts.

Confirmed Versus Suspected Attribution

Confirmed attribution groups these operations under the analytical cluster name CyberDakait based on shared lures, GitHub delivery hosts, and overlapping financial targets. However, no formal threat group has been attributed. Suspected attribution points to separate developers building the individual trojans. As the Group-IB research report notes, “While these shared behaviors confirm a common origin within the CyberDakait cluster, significant technical divergences in their C2 communication protocols, database schemas, and telemetry formatting indicate that they are likely separate projects or sub-projects.” Furthermore, leaked 2024 Telegram screenshots revealed that GhostBat developers wrote and compiled their Java code directly on Android phones using mobile tools like AIDE, MT Manager, Acode, and Apktool M.

Infection Chain

The initial GitHub-hosted application acts as a dropper tracked as d-miner. Once installed, the app displays a fake Google Play Store update screen that installs a second, separate remote access trojan in the background. It also asks the user to disable Android battery optimization so the operating system cannot stop its background services. Meanwhile, d-miner decrypts an AES-CBC payload to run an XMRig cryptocurrency miner. It uses device wake locks, foreground notifications, and a silent audio loop exploit.

Four-Stage Phishing Flow

To steal banking secrets, the fake cancellation app guides victims through four screens. First, it asks for the credit card number, expiration date, and CVV code. Second, under a Know Your Customer pretext, it requests internet banking credentials and the security grid numbers from the back of the card. Third, it collects the victim’s mobile number, date of birth, and Permanent Account Number (PAN). Fourth, it instructs the victim to upload a photograph of the front of their credit card.

Command-and-Control and Data-Exfiltration Behavior

Researchers classified the payloads dropped during the CyberDakait Android malware campaign into seven distinct families: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat (which encompasses older GhostGrab builds), and tenxen. Depending on the family, the malware sends device check-ins and stolen messages to Telegram bots, Firebase databases, or remote HTTP servers. By analyzing 2,805 installation alerts on Telegram, researchers identified 2,364 unique infected phones. The exposed Firebase storage revealed another 15,596 devices, bringing the confirmed total to 17,960 victims. In total, the operators intercepted 7,611,443 SMS messages containing one-time passwords and bank alerts. Public case studies cited over $30,500 in direct losses.

In addition, researchers found a dedicated Android administration controller APK in a GitHub repository used to manage cyb3rx infections. As the report explains, “Threat actors utilize this tool to monitor victim data and issue Command and Control (C2) instructions.” Through hardcoded API paths, operators use their phones to toggle global SMS forwarding, activate call forwarding, run custom USSD codes, and fetch stolen card records.

Defense and Detection Guidance

Because the Indian CyberDakait Android malware relies on social engineering and sideloaded apps, customers should never download banking utilities from WhatsApp or SMS links. Users must verify unexpected credit card cancellation calls through official bank phone numbers. They should refuse SMS, call-forwarding, or battery-exemption permissions for unverified apps. Finally, anyone who entered details into a suspected Credit Card Protection Plan app should contact their bank immediately to freeze their accounts. They should also reissue exposed credit cards and reset their internet banking passwords from a clean device.

×

Support Our Threat Intelligence

Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.