Digital Lutera
Digital Lutera is a malicious Android LSPosed module used in financial fraud campaigns targeting India’s mobile payment and UPI ecosystem. Rather than modifying payment APKs directly, it hooks system-level Android APIs, allowing legitimate payment apps to remain signature-valid while bypassing defenses focused on repackaged applications. Reported functionality includes hooking SmsManager and TelephonyManager APIs to intercept SIM-binding and registration tokens, spoof phone-number identity data, suppress real SMS transmission, exfiltrate 2FA or registration data to Telegram, and insert forged records into the device’s SMS sent database so apps believe authentication messages were sent from the victim device. The toolkit also reportedly uses Socket.IO for real-time command-and-control and stores configuration in /data/local/tmp/sms_hook_config.json; cited components include HttpServerService.java, SmsContentInserter.java, and ConfigManager.java, and a reported C2 endpoint is https://noob-production.up.railway.app. The attack model described requires a rooted attacker-controlled Android device with LSPosed installed and a separately compromised victim device already infected via trojanized APK lures such as fake Wedding Invitation or Vahan Chalan apps that can read, delete, forward, or intercept SMS. Reported outcomes include unauthorized account takeover, PIN reset, and fraudulent fund transfers. The activity is attributed in the source material to a Telegram actor using the alias Berlin and handle @Syntext_Erorr, with targeting focused on Indian fintech and banking applications including Axis Mobile and UPI-related workflows.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Because the malicious module ( the one we analyzed was named ‘Digital Lutera’) hooks system-level APIs rather than the app itself..."
"Because the malicious module ( the one we analyzed was named ‘Digital Lutera’) hooks system-level APIs rather than the app itself..."
"Because the malicious module ( the one we analyzed was named ‘Digital Lutera’) hooks system-level APIs rather than the app itself..."
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
The code calls runAsRoot("chmod 666 ..."). This ensures that even though the file is created in a protected system directory, the module (running within different app processes) can always read and write to it.
This attack methodology represents a shift from Application Modification (changing the app) to Runtime Environment Manipulation (changing the world the app lives in). By using LSPosed, the threat actor ensures the payment app’s signature remains valid... it 'hooks' into the application’s memory while it is running, allowing the module to change the behavior of specific Java methods.
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
4 techniques
Stealth
Because it operates at the system level, it can effectively 'blind' apps to their own security status... a malicious module can hook the system APIs that check for root access, making the device appear 'clean' to a banking app while the framework is simultaneously stealing data in the background.
A malicious file is often accompanied by socially engineered labels, such as wedding invitations, housewarming ceremonies, or private party invitations... It often mimics utility tools
fabricated "sent" SMS records are inserted into message histories in order to maintain an illusion of legitimate activity
This attack methodology represents a shift from Application Modification (changing the app) to Runtime Environment Manipulation (changing the world the app lives in). By using LSPosed, the threat actor ensures the payment app’s signature remains valid... it 'hooks' into the application’s memory while it is running, allowing the module to change the behavior of specific Java methods.
Defense Impairment
1 technique
Defense Impairment
Credential Access
4 techniques
Credential Access
the malware can intercept one-time passwords, monitor banking and UPI sessions in real-time, and harvest financial credentials directly from user screen activity
When the server sends a login OTP to the victim, the Trojan silently intercepts it and forwards it to an attacker-controlled panel... The bank sends a reset OTP to the victim’s number, which the Trojan again intercepts and forwards to the attacker.
Collection
1 technique
Collection
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Android-focused malicious toolkit used in fraudulent invitation and notice APK campaigns to gain SMS-related access, intercept bank registration messages and OTPs, forward them to attacker-controlled Telegram channels, manipulate SMS workflows, and facilitate unauthorized UPI account registration and financial fraud.
An Android LSPosed-based malicious module used to hijack legitimate payment apps at runtime, intercept and block registration SMS, spoof phone numbers, exfiltrate 2FA and binding tokens to Telegram, receive real-time C2 commands over Socket.IO, and insert forged SMS records to bypass SIM-binding controls for financial fraud.
An Android LSPosed/Xposed-style malicious module used to bypass UPI SIM-binding and device fingerprinting by hooking system APIs (e.g., SmsManager/SmsManager.sendTextMessage, TelephonyManager.getLine1Number, SubscriptionInfo.getNumber), exfiltrating registration/OTP data to Telegram, maintaining real-time C2 via Socket.IO, and forging local SMS 'Sent' records by inserting into the SMS content provider to make fraudulent registration appear legitimate.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.