Android Malware Poses as SBI Card, Axis Bank Apps to Harvest Financial Information from Users

A newly discovered Android malware campaign has emerged, targeting Hindi-speaking users in India with a unique dual-threat attack.

Uncovered by McAfee’s Mobile Research Team, the malware is being distributed through fake banking websites that impersonate trusted Indian financial institutions, including SBI Card, Axis Bank, and IndusInd Bank.

The campaign employs convincing phishing tactics, using logos and content copied from official sites to lure victims into installing a malicious Android app.

Dual-Purpose Malware: Data Theft Meets Cryptomining

What sets this campaign apart is its ability to steal sensitive financial information while silently hijacking infected devices’ resources to mine Monero cryptocurrency.

The spoofed apps demand users “update” their app, masquerading as a legitimate Google Play update screen.

Once installed, the fake app appears to function like a genuine banking service, prompting users to enter confidential details such as their name, card number, CVV, and expiration date.

This harvested information is swiftly transmitted to the attackers’ command-and-control server, putting users at serious risk of fraud. Behind the scenes, the app employs a complex, multi-stage loading process to avoid detection.

The malicious APK initially contains an encrypted file that, when decrypted, loads further encrypted code in memory. This staged approach makes detection by regular security tools much harder, as no harmful code is exposed until runtime.

A more insidious aspect of this campaign is its use of Firebase Cloud Messaging (FCM). By abusing FCM’s push notification system, attackers can remotely trigger a hidden cryptocurrency mining process on infected devices.

The malware downloads and executes an encrypted native binary, effectively an XMRig miner, which utilizes the device’s CPU to mine Monero in the background.

Monero is favored by cybercriminals for its privacy features and can be efficiently mined on mobile devices due to its CPU-optimized RandomX algorithm.

Stealth and Sophistication Raise the Bar on Mobile Threats

The campaign is primarily confined to India, likely because it features Hindi-language phishing pages and leverages genuine assets from Indian banks.

By spreading via rapidly created phishing sites with authentic-looking web resources, the attackers increase the likelihood of success while avoiding detection by conventional anti-malware solutions.

McAfee has reported the malicious apps to Google, leading to the suspension of the associated FCM accounts. The company’s security solutions now detect and block these high-risk threats.

Protecting Yourself: Simple Steps Can Make a Difference

Users are advised to download apps only from trusted sources like Google Play, be cautious of unsolicited links, and refrain from sharing sensitive financial information with unfamiliar apps.

Enabling security solutions that screen for malicious apps and phishing sites provides an essential last line of defense against evolving mobile threats like this.

With cybercriminals advancing new tactics that combine financial scams and cryptomining, vigilance and robust security remain crucial for mobile users, especially in regions most frequently targeted by such attacks.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates