Rewardsteal
Rewardsteal is an Android banking Trojan family active primarily in India. Kaspersky reporting cited in the provided content repeatedly identifies Rewardsteal as a banker targeting Indian users, including activity observed in 2024, Q2 2025, Q3 2025, and Q1 2026. It has been described as a banking trojan camouflaged as software purportedly backed by major Indian credit or financial organizations, including ICICI, SBI, Axis, and PM Kisan. The malware is associated with mobile banking-trojan activity rather than general adware or spyware campaigns, and it appears alongside other Android banker families such as Mamont, Faketoken, Creduz, and Coper in Kaspersky’s regional threat reporting. High-confidence details in the content indicate that Rewardsteal specifically targeted users in India; however, the provided material does not include deeper technical specifics such as persistence mechanisms, permissions abuse, command-and-control infrastructure, or concrete indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mobile banking trojan family mentioned among active banker threats.
Android banking trojan family targeting India, masquerading as apps associated with major financial institutions/government-linked schemes to steal banking data.
Banking trojan family active in India, masquerading as apps associated with major financial institutions to steal banking data.
Rewardsteal is a mobile banking trojan active in India, used to steal financial data from users.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.