Threat reportMalwareTL-2026-4625
CyberDakait: Seven Android Trojan Families (GhostBat, cyb3rx, appkjl, godz, d-passive, d-shine, tenxen) Targeting Indian Banking Customers
CyberDakait: Seven Android Trojan Families (GhostBat (TL-2026-4625), also tracked as CyberDakait, is a high-severity malware campaign, first published 2026-10-28. It is attributed to CyberDakait with medium confidence, affects Google Android (customers of Indian banking apps; 11 banks and 2, maps to 21 MITRE ATT&CK techniques (T1406, T1417.001, T1417.002), and is covered by 9 detection rules and 37 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1CyberDakait
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-4625
- Threat ID
- TL-2026-4625
- Also known as
- CyberDakait, GhostGrab
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- CyberDakait
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, government administration
- Target regions
- india
- Detection rules
- 9
- Indicators of compromise
- 37
Malware and tooling in CyberDakait: Seven Android Trojan Families (GhostBat
Malware and tooling: GhostBat, xmrig, XMRig
How CyberDakait: Seven Android Trojan Families (GhostBat works
Group-IB reports a financially motivated cluster, CyberDakait, operating seven Android trojan families against Indian banking customers via vishing/smishing, phishing sites and GitHub-hosted APKs. Group-IB counts 17,960 compromised devices, 7.6 million intercepted SMS messages and over $30,500 in documented losses.
CyberDakait is the name Group-IB gives to a cluster operating seven Android malware families: GhostBat (also called GhostGrab), cyb3rx, appkjl, godz, d-passive, d-shine and tenxen. The cluster targets Indian banking customers. Group-IB says 11 Indian banks and 2 government programs are impersonated (including ICICI Bank, HDFC Bank, PNB and IDFC). Victim reports are documented from January 2025 onward, Group-IB threat intelligence dates initial activity to July 2025, and the campaign is described as ongoing.
The social-engineering chain has four stages. First, victims get fraudulent calls or SMS messages from people posing as bank representatives, often about cancelling a 'Credit Card Protection Plan'. Second, they are sent to fake bank sites, including links delivered over WhatsApp. Third, a malicious APK is downloaded from GitHub-hosted repositories. Group-IB describes hundreds of such repositories (16 GitHub accounts identified) and 60+ phishing domains. Fourth, a fake Google Play update screen masks installation of a secondary payload. The phishing flow harvests card number, expiry and CVV, then internet-banking credentials and grid numbers, then mobile number, PAN and date of birth, and finally photos of the card front and back.
The malware has RAT features: SMS interception, forwarding and sending, call forwarding, overlay-based card theft, and abuse of SMS-read, call-log, phone-state, device-admin and Accessibility permissions. All seven families carry SMS interception, call forwarding, phishing overlay and cryptojacking capability per Group-IB's family table. Some builds include an XMRig-based cryptominer reaching pool.fud2026.com and pool-proxy.fud2026.com on port 9000. Group-IB describes wake locks, a foreground service with notification channels, battery-optimization exemption requests and a silent audio loop for persistence, and AES/CBC/PKCS5Padding encryption for payload delivery. C2 runs over three channels: Telegram bots (emoji-formatted messages), Firebase Realtime Database and remote HTTP servers (endpoints such as /api/add_sms.php and /message.php). GhostBat uses Firebase and Telegram, cyb3rx uses Telegram plus remote servers, d-passive, godz and tenxen use Firebase, and d-shine and appkjl use remote servers. Sample commands include call_forward_activate/deactivate, set_sms_forwarding, custom_ussd, get_device_info and send_sms (cyb3rx); checkLiveness, callForward, smsForward, KeyLogger and sendSms (GhostBat); and enableCallForwarding, disableCallForwarding, forwardSms and checkCallForwarding (tenxen). The cyb3rx family includes a GitHub-hosted admin controller APK for operators.
Group-IB found evidence that the operators build and edit malware on Android devices, citing AIDE IDE, MT Manager, Acode, Apktool M, Firebase configuration files and .java sources, with developer screenshots shared on Telegram dating to 2024. Of the 17,960 devices, 2,364 are unique devices confirmed by UUID and 15,596 were identified through Firebase; 7,611,443 SMS messages were intercepted. Group-IB reported the identified GitHub profiles and repositories for deactivation. No CVE is involved, and no nation-state attribution is stated in the source.
MITRE ATT&CK techniques used in TL-2026-4625
Defense Evasion
T1406 Obfuscated Files or Information; T1655.001 Masquerading: Match Legitimate Name or Location
Credential Access
T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture
Discovery
T1426 System Information Discovery
Command and Control
T1437.001 Application Layer Protocol: Web Protocols; T1481 Web Service; T1544 Ingress Tool Transfer; T1571 Non-Standard Port
Impact
T1496.001 Resource Hijacking: Compute Hijacking; T1582 SMS Control; T1616 Call Control
Collection
T1517 Access Notifications; T1636.004 Protected User Data: SMS Messages
Persistence
Initial Access
T1566.002 Phishing: Spearphishing Link; T1566.004 Phishing: Spearphishing Voice; T1660 Phishing
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1608.001 Stage Capabilities: Upload Malware
Exfiltration
Affected products and versions in CyberDakait: Seven Android Trojan Families (GhostBat
- Google — Android (customers of Indian banking apps; 11 banks and 2 government programs impersonated)
Vulnerable versions: Devices that sideload the malicious APKs and grant SMS and Accessibility permissions
Remediation for CyberDakait: Seven Android Trojan Families (GhostBat
Immediate actions
- Block the listed phishing domains, C2 IPs and fud2026.com mining-pool hosts at DNS, proxy and firewall layers
- Instruct customers to verify bank calls via official numbers and never share card details, CVV or PIN
- If compromise is suspected, freeze affected accounts, disable SMS and call forwarding, and preserve device forensics before lockdown
- Search mobile device management and fraud telemetry for the listed APK SHA256 hashes
Workarounds
- Install apps only from the official Google Play Store
- Do not grant Accessibility Service or SMS read permissions to unfamiliar apps
- Treat any 'Google Play update' screen shown inside an app as hostile
Longer-term hardening
- Monitor for lookalike domains impersonating your brand and request takedowns
- Track GitHub abuse for APK distribution and report malicious repositories and accounts
- Deploy mobile threat defense and fraud analytics that detect SMS interception and call-forwarding changes
- Run customer education on bank-impersonation vishing and smishing
Timeline of CyberDakait: Seven Android Trojan Families (GhostBat
- Developer screenshots shared on Telegram dating to 2024 show malware being built on Android devices (year only stated by Group-IB; month and day approximated)
- Group-IB documents victim reports from January 2025 onward (month only stated; day approximated)
- Initial activity of July 2025 cited by Group-IB per its threat intelligence (month only stated; day approximated)
- Cyble publishes research on the GhostBat RAT (RTO-themed Android malware targeting Indian users); GhostBat is one of the seven CyberDakait families
- Zimperium publishes zero-day coverage of the GhostBat RAT campaign
- Group-IB reports the identified GitHub profiles and repositories hosting the malicious APKs to GitHub for deactivation (undated in source; dated to publication)
- Group-IB publishes the CyberDakait report: seven families, 17,960 compromised devices (2,364 unique UUIDs, 15,596 via Firebase), 7,611,443 intercepted SMS messages, over $30,500 documented losses
Sources cited for CyberDakait: Seven Android Trojan Families (GhostBat
- False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps
- GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware (Cyble)
- Rapid Response: Zimperium's Zero-Day Coverage of GhostBat RAT Campaign
- GhostBat RAT Malware Targets Indian Users Through Fake RTO Apps
- Reemergent GhostBat RAT malware targets India (SC Media)
- GhostBat Android RAT Targets 60 Indian Banking and UPI Apps
Detection coverage for TL-2026-4625
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4625 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.