In recent years, Android malware campaigns in India have increasingly abused the trust associated with government services and official digital platforms.
By mimicking well-known portals and leveraging social engineering via messaging apps, threat actors exploit users’ urgency and lack of verification, resulting in large-scale financial fraud and identity theft.
Seqrite Labs identified an active Android malware campaign targeting Indian users by impersonating RTO challan notifications and official alerts.
These malicious apps spread outside the Google Play Store, mainly via WhatsApp messages with urgent “pay your challan now” lures.
This campaign evolves from earlier RTO-themed malware. It features improved anti-analysis tricks, a modular three-stage design, and a structured backend for data theft and remote control.
The setup maximizes infection, persistence, monetization, and data harvesting while allowing attackers to update parts independently for better evasion.
Multi-Stage Infection and Backend Operations
The campaign unfolds in three chained APKs, each with specific roles (see typical flow: WhatsApp lure → Stage 1 dropper → Stage 2 persistence → Stage 3 theft).
Stage 1: Dropper and Cryptominer
This initial app decrypts and installs Stages 2 and 3. It also runs cryptocurrency mining when the device is locked, hiding activity during user inactivity like previous cryptojacking seen in banking apps. Mining stops once Stage 2 activates.
Stage 2: Persistence and Bridge
Dropped by Stage 1, it sets up persistence via broadcast receivers, hides its icon, and runs in the background. It connects to a Google Firebase backend for data storage, remote configs, and C2. Stage 2 also mines crypto, bridging infection to full surveillance.
Stage 3: Data Theft and Fraud
This final payload mimics RTO/government UIs, urging users to “verify” or pay challans. It requests permissions like SMS, calls, notifications, and storage.
Once granted, it steals PII (names, Aadhaar, PAN), financial data (UPI PINs, cards, banking creds), OTPs, SMS, and device info echoing NextGen mParivahan tactics. JSON data uploads to the backend.
Seqrite accessed the backend, revealing active operations. It stored sensitive victim data in structured formats:
| Data Type | Examples |
|---|---|
| PII | Name, phone, DOB, Aadhaar, PAN |
| Financial | UPI PINs, card details, bank logins |
| Surveillance | SMS, notifications, device logs |
As C2, it enabled remote tweaks such as SMS/call forwarding configurations, live monitoring, and device tracking indicating a mature operation.
Around 7,400 devices were hit, with many yielding SMS access and financial info. This scales to real harm: OTP theft for fraud, account takeovers, SIM swaps, and loans via stolen IDs.
Key Improvements and Risks
| Aspect | Earlier RTO Malware | This Campaign |
|---|---|---|
| Design | Single-stage | Three-stage modular |
| Config | Hardcoded | Dynamic remote |
| Evasion | Basic | Advanced anti-analysis |
| Theft | Limited | Full surveillance |
| Monetization | None | Mining + fraud |
Mapped to MITRE ATT&CK: TA0001 (Initial Access via phishing), TA0003 (Persistence), T1556 (Modify Auth), T1027 (Obfuscated Files).
Abuse risks include real-time bank fraud, social hijacks, and identity theft.
Quick Heal detects variants as Android.Dropper.A. Install “Quick Heal Mobile Security for Android” from Google Play to block downloads.
This campaign marks an escalation: organized, multi-monetized, cloud-driven threats demanding vigilance against fake government alerts.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
