Cybersecurity researchers at CloudSEK have identified MR ROBOT, an Android Malware-as-a-Service (MaaS) operation that allows fraudsters to generate fake banking applications, steal one-time passwords (OTPs) and redirect victims’ phone calls.
The operation provides affiliates with a control panel to select banks to impersonate and distribute fraudulent applications through links shared on WhatsApp, SMS and Telegram. According to CloudSEK’s investigation, the platform also supports fake payment applications and traffic-fine pages designed to collect personal and financial information.
Researchers traced the operation while investigating an Android application impersonating a public-sector bank. Their analysis of the malware’s administrative application led them to the platform’s control panel and a Telegram bot called APK Shield, which provides access to its catalogue of fraudulent applications.
Crimeware platform offers bank-specific fake apps
MR ROBOT operates through a subscription-based model in which customers, referred to as affiliates, can select a target bank from a dropdown menu in the control panel. The platform then generates a fake application designed to resemble the selected bank’s official app, alongside a counterfeit Play Store page.
The generated links can be distributed through messaging services, including WhatsApp, SMS and Telegram, to persuade customers to install the applications.
The platform’s access is sold through time-limited licences, with the control panel displaying the remaining validity of a subscription. It also offers tiered access through sub-administrator panels for lower-level customers.
CloudSEK researchers found approximately 36 lure applications in the Telegram bot’s catalogue. These included fake applications impersonating nine public- and private-sector banks, as well as services related to gas, water and electricity bill payments.
The catalogue also contained fake Regional Transport Office (RTO) challan pages. These pages reportedly charged a small fee of ₹9 to ₹10 while collecting PAN details and other personal information.
The platform includes a function that allows affiliates to delete intercepted messages with a single click, potentially removing evidence of the stolen information from their dashboards.
Malware intercepts OTPs and redirects calls
Once installed, the malware can read incoming SMS messages and capture OTPs sent by banks and other services. It also uses the *21# call-forwarding code to redirect victims’ incoming calls to numbers controlled by fraudsters.
This can prevent customers from receiving calls from their banks, including calls made to verify suspicious transactions or confirm account activity.
The fake applications also present screens designed to collect sensitive information, including Aadhaar and PAN details, card numbers, CVVs, ATM PINs, UPI PINs and net-banking credentials.
The combination of intercepted SMS messages, stolen banking credentials and redirected calls gives fraudsters multiple ways to compromise victims’ accounts and interfere with attempts by banks to contact customers.
Exposed database reveals scale of activity
CloudSEK’s investigation identified activity across two affiliates, providing researchers with an indication of the operation’s reach.
One affiliate’s account showed approximately 154 infected phones and 3,270 intercepted messages. A second affiliate had an exposed database containing records of 153 infected phones and 5,407 intercepted SMS messages as of July 30, 2026.
The second database included OTPs associated with more than a dozen banks and payments banks. Call forwarding was active on 58% of the recorded victims’ devices. Researchers also found that 149 phones had been infected in a single burst in May.
The affected devices were predominantly budget Android smartphones, and the victims used SIM cards from all four major Indian telecom carriers, according to the investigation.
These findings show that the operation is not limited to impersonating one bank or targeting customers of a single telecom provider. Its catalogue allows affiliates to switch between different financial institutions and other services.
Malware uses techniques to evade detection
MR ROBOT incorporates measures intended to make detection more difficult. According to CloudSEK, the malware remains dormant for at least 48 hours after installation, potentially allowing it to get past automated security checks before beginning its activity.
Each copy also carries a new digital signature. This makes it harder for security tools to identify new versions by matching their signatures against previously detected samples.
Researchers found that the operation uses tactics seen in earlier India-focused campaigns, including FatBoyPanel and RedWing. However, the MR ROBOT toolkit, control panel and Telegram storefront did not appear in the public threat intelligence reporting examined during the investigation.
Researchers recommend coordinated takedowns
CloudSEK identified a potential disruption point in the way the malware handles stolen data. Although affiliates can generate fake applications for different banks, the applications operated by each affiliate send stolen information to a single Firebase database.
Researchers said taking down that database could interrupt the collection of stolen data across the affiliate’s applications until the operator moved to another database.
The investigation recommends coordinated takedown requests targeting the services used by the operation, including Firebase, Cloudflare and Telegram. It also calls for an advisory from India’s Computer Emergency Response Team (CERT-In).
The investigation also recommends that banks move away from SMS-based OTPs where possible. Customers should avoid installing banking or Aadhaar-related applications through links received over SMS, WhatsApp or Telegram and should instead use official app stores or verified service channels.