Threat reportMalwareTL-2026-4615
MR ROBOT Android Malware-as-a-Service Targeting Indian Bank Customers
MR ROBOT Android Malware-as-a-Service Targeting Indian Bank (TL-2026-4615), also tracked as MR ROBOT, is a high-severity malware campaign, first published 2026-10-28. It has no confirmed attribution, affects Google Android, maps to 14 MITRE ATT&CK techniques (T1398, T1406, T1407), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4615
- Threat ID
- TL-2026-4615
- Also known as
- MR ROBOT, APK Shield
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, telecoms, government administration
- Target regions
- india
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in MR ROBOT Android Malware-as-a-Service Targeting Indian Bank
Malware and tooling: MR ROBOT, CloudFlare Tunnel, MR ROBOT panel v7.0
How MR ROBOT Android Malware-as-a-Service Targeting Indian Bank works
CloudSEK documents MR ROBOT, an Android banking-trojan malware-as-a-service sold through a Telegram bot ('APK Shield') that mints Play-Store-style install links for ~36 bank, utility and Aadhaar/KYC lures. The trojan intercepts SMS/OTPs, silently enables *21*<number># call forwarding to defeat voice verification, and uses HTML overlays to harvest Aadhaar, PAN, card, ATM PIN and UPI credentials.
MR ROBOT is a tiered malware-as-a-service (MaaS) kit aimed at Indian bank customers, reported by CloudSEK on 2026-10-28. Affiliates interact with a Telegram storefront bot ('APK Shield', t.me/MRrobottttt070_bot) that offers roughly 36 pre-built lure applications (nine bank impersonations, utility bills, RTO traffic-fine 'challan' lures and Aadhaar/KYC update apps) behind a demo-then-paid access gate. A 'Generate Shoot URL' function mints Play-Store-style landing pages whose links are spread via SMS, WhatsApp and Telegram.
The delivered package is a multi-stage dropper. The outer installer (com.apkshield.installer.*) requests REQUEST_INSTALL_PACKAGES and QUERY_ALL_PACKAGES, carries an AES-128-CBC + GZIP encrypted stage-2 payload in assets/ (entropy ~8.0, keys hardcoded in an obfuscated loader class), uses fake-ZIP encryption flags to break naive unpackers, and embeds a local VPN service (ApkShieldVpnService) used as a traffic 'black hole'. Anti-analysis gates check emulator fingerprints (model, hardware, carrier) and enforce a 48-hour dormancy plus a minimum of three app launches before activation. The inner trojan is installed under a randomized package name read from target_pkg.txt, has no launcher icon, and each build is signed with a throwaway certificate (CN varies per build), defeating certificate-hash blocklists. Requested permissions include RECEIVE_SMS, READ_SMS, SEND_SMS, CALL_PHONE, MANAGE_OWN_CALLS, READ_PHONE_STATE and RECEIVE_BOOT_COMPLETED.
Capabilities: a high-priority SMS broadcast receiver captures OTPs and transaction alerts; silent unconditional call forwarding via the *21*<mule_number># USSD code removes bank verification callbacks from the victim; HTML/JavaScript overlays harvest Aadhaar, PAN, card number and CVV, ATM PIN, UPI PIN and net-banking credentials; the malware can send and delete SMS on-device; advanced builds enumerate and exfiltrate gallery images, installed-app inventory and battery/wake state. Data is pushed to an affiliate-specific Firebase Realtime Database (e.g. baccha-a07d9-default-rtdb.firebaseio.com) and a Telegram channel; commands are pushed through Firebase Cloud Messaging.
The operator control plane is a React/Vite single-page panel on Cloudflare Pages (live: mr-panel-bbv.pages.dev, v7.0; offline: mr-panel.pages.dev) whose backend is hidden behind ephemeral Cloudflare Tunnel hosts (*.trycloudflare.com/webview-apk). Panel code shows master-admin PIN auth, per-affiliate tenant management with a default 20 concurrent-login limit, live SMS toggles and batch delete, an on-demand APK builder (target bank selection, build modes fix_harmful/hidden/visible), FCM single/broadcast push, sub-admin reseller tiers and call-forwarding/mule-number assignment. An operator console app (com.godz.myapplication, label 'MR ROBOT', v4.2, signed CN=MrRobot, O=MrRobot, C=IN) gates access with a per-affiliate App ID such as SKY-APP-2026-X9F3.
Observed impact: Affiliate A showed ~154 enrolled devices and ~3,270 intercepted messages in the panel history. Affiliate B's exposed Firebase database held 153 enrolled devices (157 serials issued; 149 onboarded in a single 2026-05-09 burst), 5,407 SMS captured between 2026-07-16 and 2026-07-30 (peak 562 on 2026-07-25), and call forwarding active on 87 of 153 devices (58%). Victim handsets were mostly budget Android 13-16 devices across all four major Indian carriers; ~4,000 of the SMS came from bank/telecom short codes, with telecom recharge OTPs the largest volume, consistent with an account-recovery fraud chain.
Attribution: the operator is unknown. CloudSEK reports shared tradecraft with FatBoyPanel (Zimperium, Feb 2025: Firebase-based SMS/credential exfiltration targeting Indian banks) and RedWing (Zimperium, Jul 2026: Telegram-distributed MaaS, per-customer APK builder, hidden *21# call forwarding, referral scheme), but MR ROBOT's branding, APK Shield storefront, panel v7.0, com.godz.myapplication console, SKY-APP-2026-* licensing and tiered sub-admin reseller model were previously undocumented. No CVE is involved; exploitation relies on social engineering and sideloading.
MITRE ATT&CK techniques used in TL-2026-4615
Persistence
T1398 Boot or Logon Initialization Scripts
Defense Evasion
T1406 Obfuscated Files or Information; T1629 Impair Defenses; T1633.001 System Checks; T1655 Masquerading
defense-evasion
T1407 Download New Code at Runtime
Credential Access
Command and Control
T1437.001 Web Protocols; T1521 Encrypted Channel
Impact
T1582 SMS Control; T1616 Call Control
Collection
Exfiltration
T1646 Exfiltration Over C2 Channel
Initial Access
Affected products and versions in MR ROBOT Android Malware-as-a-Service Targeting Indian Bank
- Google — Android
Vulnerable versions: 13; 14; 15; 16
Remediation for MR ROBOT Android Malware-as-a-Service Targeting Indian Bank
Immediate actions
- Treat SMS OTP as compromised for any customer reporting missed bank calls or an unsolicited Aadhaar/KYC, bank, utility or challan APK install
- Advise affected customers to dial ##21# to cancel unconditional call forwarding and to uninstall the sideloaded app
- Hunt managed devices and app-vetting telemetry for com.apkshield.installer.* and com.godz.myapplication packages and the listed signing-certificate and file hashes
- Block or report mr-panel-bbv.pages.dev, mr-panel.pages.dev, baccha-a07d9-default-rtdb.firebaseio.com and t.me/MRrobottttt070_bot; request takedown from Cloudflare, Google Firebase and Telegram
Workarounds
- Never install bank, Aadhaar or utility APKs received via SMS, WhatsApp or Telegram links
- Keep Google Play Protect enabled and block installation from unknown sources
- Review apps holding SMS and CALL permissions regularly and revoke those not needed
Longer-term hardening
- Migrate customer authentication from SMS OTP to app-based or FIDO authentication
- Monitor for SIM/telecom call-forwarding changes and for account-recovery or recharge OTP bursts as fraud signals
- Alert on app signing certificates with subject C=IN, O=MrRobot, CN=MrRobot or CN=5cf73ecdf1bc839e
- Coordinate India-wide advisory with CERT-In
Timeline of MR ROBOT Android Malware-as-a-Service Targeting Indian Bank
- Zimperium publishes FatBoyPanel research: ~1,000 malicious apps, ~50,000 Indian victims, Firebase-based SMS and credential exfiltration (shared pattern with MR ROBOT).
- Affiliate B's tenant enrolls 149 victim devices in a single burst; enrollment continues through 2026-07-21 for 153 devices total.
- Zimperium zLabs discloses RedWing, a Telegram-distributed Android MaaS with per-customer builder and hidden *21# call forwarding (shared tradecraft with MR ROBOT).
- Start of the ~14-day SMS capture window retained in Affiliate B's exposed Firebase database.
- Peak day for Affiliate B: 562 SMS intercepted in one day.
- End of the Affiliate B SMS capture window; 5,407 SMS intercepted in total, call forwarding active on 87 of 153 devices (58%).
- CloudSEK publishes 'Inside MR ROBOT', documenting the APK Shield storefront, live panel v7.0, dropper family and affiliate statistics.
Sources cited for MR ROBOT Android Malware-as-a-Service Targeting Indian Bank
- Inside MR ROBOT: Malware-as-a-Service Targeting Indian Bank Customers (CloudSEK)
- RedWing: A Mobile Malware-as-a-Service Operation (Zimperium zLabs)
- Mobile Indian Cyber Heist: FatBoyPanel and His Massive Data Breach (Zimperium)
- RedWing Android Spyware Sold as a Service on Telegram (Infosecurity Magazine)
- Telegram-Hosted RedWing Malware Lets Anyone Rent Android Spyware Tools (Security Affairs)
- 1,000 Apps Used in Malicious Campaign Targeting Android Users in India (SecurityWeek)
- Mobile Malware Targeting Indian Banks Exposes 50,000 Users (Infosecurity Magazine)
Detection coverage for TL-2026-4615
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4615 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.