NexusRoute
NexusRoute is an Android malware campaign targeting users in India. It uses phishing portals impersonating Indian government services to redirect victims to malicious APKs hosted on GitHub repositories and GitHub Pages, while also collecting personal and financial information. Reported capabilities include theft of mobile numbers, vehicle data, UPI PINs, OTPs, and card details, as well as extensive surveillance of infected devices. The activity has been linked in reporting to a broader underground development ecosystem via the email address gymkhana.studio@gmail[.]com. The campaign has been analyzed by CYFIRMA and Kaspersky.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated in the report’s aggregated section with exploitation activity around React2Shell (CVE-2025-55182) and related RSC/Next.js vulnerabilities. (Note: 'NexusRoute' also appears as malware elsewhere in the same aggregated list.)
Named in an aggregated list of actors associated with React2Shell (CVE-2025-55182) exploitation activity; also appears as a malware name elsewhere in the content, but here is explicitly listed under Threat Actors.
NexusRoute is a professionally engineered Android malware campaign targeting users in India, combining phishing, malware, financial fraud, and surveillance, and leveraging government branding and automated infrastructure.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.