MR ROBOT

MR ROBOT is an Android banking trojan distributed through a subscription-based Malware-as-a-Service operation targeting customers of Indian banks. Its operators rent affiliates access to customized malicious applications, a Telegram-based storefront and builder called APK Shield, and a web-based management panel. The service supports expiring affiliate licenses, sub-administrator accounts, personalized builds, and victim management. Approximately 36 application lures impersonate banks, Aadhaar/KYC update services, utility providers, telecommunications providers, and government services. Distribution uses messaging-app links and counterfeit Google Play Store-style installation pages.

The malware captures incoming SMS messages and one-time passwords and uses HTML phishing overlays to steal online-banking credentials, payment-card details, ATM and UPI PINs, and identity information. It can silently enable unconditional call forwarding to attacker-controlled numbers, diverting incoming calls, including bank fraud-verification callbacks. Stolen information is transmitted through Firebase Realtime Database and Telegram, while Firebase Cloud Messaging supports operator commands. The management platform also supports sending and deleting SMS messages and controlling call forwarding.

Its installation chain uses an obfuscated dropper to decrypt and decompress an embedded banking-trojan payload. Anti-analysis and concealment mechanisms include emulator checks, delayed activation, randomized signing certificates and package names, and removal of the launcher icon. Boot-completion handling supports persistence. An exposed affiliate database contained records for 153 infected devices and 5,407 intercepted SMS messages, with call forwarding active on 58% of those devices. The operation uses a multi-tenant affiliate model; no named threat actor has been established as its operator.