# MR ROBOT Android Malware-as-a-Service Targeting Indian Bank Customers

> CloudSEK documents MR ROBOT, an Android banking-trojan malware-as-a-service sold through a Telegram bot ('APK Shield') that mints Play-Store-style install links for ~36 bank, utility and Aadhaar/KYC lures. The trojan intercepts SMS/OTPs, silently enables *21*<number># call forwarding to defeat voice verification, and uses HTML overlays to harvest Aadhaar, PAN, card, ATM PIN and UPI credentials.

- **Published:** 2026-10-28T06:54:26Z
- **Last reviewed:** 2026-10-28T06:54:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4615
- **ID:** TL-2026-4615
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MR ROBOT is a tiered malware-as-a-service (MaaS) kit aimed at Indian bank customers, reported by CloudSEK on 2026-10-28. Affiliates interact with a Telegram storefront bot ('APK Shield', t.me/MRrobottttt070_bot) that offers roughly 36 pre-built lure applications (nine bank impersonations, utility bills, RTO traffic-fine 'challan' lures and Aadhaar/KYC update apps) behind a demo-then-paid access gate. A 'Generate Shoot URL' function mints Play-Store-style landing pages whose links are spread via SMS, WhatsApp and Telegram.

The delivered package is a multi-stage dropper. The outer installer (com.apkshield.installer.*) requests REQUEST_INSTALL_PACKAGES and QUERY_ALL_PACKAGES, carries an AES-128-CBC + GZIP encrypted stage-2 payload in assets/ (entropy ~8.0, keys hardcoded in an obfuscated loader class), uses fake-ZIP encryption flags to break naive unpackers, and embeds a local VPN service (ApkShieldVpnService) used as a traffic 'black hole'. Anti-analysis gates check emulator fingerprints (model, hardware, carrier) and enforce a 48-hour dormancy plus a minimum of three app launches before activation. The inner trojan is installed under a randomized package name read from target_pkg.txt, has no launcher icon, and each build is signed with a throwaway certificate (CN varies per build), defeating certificate-hash blocklists. Requested permissions include RECEIVE_SMS, READ_SMS, SEND_SMS, CALL_PHONE, MANAGE_OWN_CALLS, READ_PHONE_STATE and RECEIVE_BOOT_COMPLETED.

Capabilities: a high-priority SMS broadcast receiver captures OTPs and transaction alerts; silent unconditional call forwarding via the *21*<mule_number># USSD code removes bank verification callbacks from the victim; HTML/JavaScript overlays harvest Aadhaar, PAN, card number and CVV, ATM PIN, UPI PIN and net-banking credentials; the malware can send and delete SMS on-device; advanced builds enumerate and exfiltrate gallery images, installed-app inventory and battery/wake state. Data is pushed to an affiliate-specific Firebase Realtime Database (e.g. baccha-a07d9-default-rtdb.firebaseio.com) and a Telegram channel; commands are pushed through Firebase Cloud Messaging.

The operator control plane is a React/Vite single-page panel on Cloudflare Pages (live: mr-panel-bbv.pages.dev, v7.0; offline: mr-panel.pages.dev) whose backend is hidden behind ephemeral Cloudflare Tunnel hosts (*.trycloudflare.com/webview-apk). Panel code shows master-admin PIN auth, per-affiliate tenant management with a default 20 concurrent-login limit, live SMS toggles and batch delete, an on-demand APK builder (target bank selection, build modes fix_harmful/hidden/visible), FCM single/broadcast push, sub-admin reseller tiers and call-forwarding/mule-number assignment. An operator console app (com.godz.myapplication, label 'MR ROBOT', v4.2, signed CN=MrRobot, O=MrRobot, C=IN) gates access with a per-affiliate App ID such as SKY-APP-2026-X9F3.

Observed impact: Affiliate A showed ~154 enrolled devices and ~3,270 intercepted messages in the panel history. Affiliate B's exposed Firebase database held 153 enrolled devices (157 serials issued; 149 onboarded in a single 2026-05-09 burst), 5,407 SMS captured between 2026-07-16 and 2026-07-30 (peak 562 on 2026-07-25), and call forwarding active on 87 of 153 devices (58%). Victim handsets were mostly budget Android 13-16 devices across all four major Indian carriers; ~4,000 of the SMS came from bank/telecom short codes, with telecom recharge OTPs the largest volume, consistent with an account-recovery fraud chain.

Attribution: the operator is unknown. CloudSEK reports shared tradecraft with FatBoyPanel (Zimperium, Feb 2025: Firebase-based SMS/credential exfiltration targeting Indian banks) and RedWing (Zimperium, Jul 2026: Telegram-distributed MaaS, per-customer APK builder, hidden *21# call forwarding, referral scheme), but MR ROBOT's branding, APK Shield storefront, panel v7.0, com.godz.myapplication console, SKY-APP-2026-* licensing and tiered sub-admin reseller model were previously undocumented. No CVE is involved; exploitation relies on social engineering and sideloading.

## MITRE ATT&CK

- T1660 Phishing
- T1655 Masquerading
- T1407 Download New Code at Runtime
- T1406 Obfuscated Files or Information
- T1633.001 System Checks
- T1629 Impair Defenses
- T1398 Boot or Logon Initialization Scripts
- T1636.004 SMS Messages
- T1417.002 GUI Input Capture
- T1582 SMS Control
- T1616 Call Control
- T1437.001 Web Protocols
- T1521 Encrypted Channel
- T1646 Exfiltration Over C2 Channel

## Sources

- [Inside MR ROBOT: Malware-as-a-Service Targeting Indian Bank Customers (CloudSEK)](https://www.cloudsek.com/blog/inside-mr-robot-malware-as-a-service-targeting-indian-bank-customers)
- [RedWing: A Mobile Malware-as-a-Service Operation (Zimperium zLabs)](https://zimperium.com/blog/redwing-a-mobile-malware-as-a-service-operation)
- [Mobile Indian Cyber Heist: FatBoyPanel and His Massive Data Breach (Zimperium)](https://www.zimperium.com/blog/mobile-indian-cyber-heist-fatboypanel-and-his-massive-data-breach)
- [RedWing Android Spyware Sold as a Service on Telegram (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/redwing-android-spyware-maas)
- [Telegram-Hosted RedWing Malware Lets Anyone Rent Android Spyware Tools (Security Affairs)](https://securityaffairs.com/194942/malware/telegram-hosted-redwing-malware-lets-anyone-rent-android-spyware-tools.html)
- [1,000 Apps Used in Malicious Campaign Targeting Android Users in India (SecurityWeek)](https://www.securityweek.com/1000-apps-used-in-malicious-campaign-targeting-android-users-in-india/)
- [Mobile Malware Targeting Indian Banks Exposes 50,000 Users (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/mobile-malware-indian-banks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4615