# CyberDakait: Seven Android Trojan Families (GhostBat, cyb3rx, appkjl, godz, d-passive, d-shine, tenxen) Targeting Indian Banking Customers

> Group-IB reports a financially motivated cluster, CyberDakait, operating seven Android trojan families against Indian banking customers via vishing/smishing, phishing sites and GitHub-hosted APKs. Group-IB counts 17,960 compromised devices, 7.6 million intercepted SMS messages and over $30,500 in documented losses.

- **Published:** 2026-10-28T09:04:25Z
- **Last reviewed:** 2026-10-28T09:04:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4625
- **ID:** TL-2026-4625
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** CyberDakait
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CyberDakait is the name Group-IB gives to a cluster operating seven Android malware families: GhostBat (also called GhostGrab), cyb3rx, appkjl, godz, d-passive, d-shine and tenxen. The cluster targets Indian banking customers. Group-IB says 11 Indian banks and 2 government programs are impersonated (including ICICI Bank, HDFC Bank, PNB and IDFC). Victim reports are documented from January 2025 onward, Group-IB threat intelligence dates initial activity to July 2025, and the campaign is described as ongoing.

The social-engineering chain has four stages. First, victims get fraudulent calls or SMS messages from people posing as bank representatives, often about cancelling a 'Credit Card Protection Plan'. Second, they are sent to fake bank sites, including links delivered over WhatsApp. Third, a malicious APK is downloaded from GitHub-hosted repositories. Group-IB describes hundreds of such repositories (16 GitHub accounts identified) and 60+ phishing domains. Fourth, a fake Google Play update screen masks installation of a secondary payload. The phishing flow harvests card number, expiry and CVV, then internet-banking credentials and grid numbers, then mobile number, PAN and date of birth, and finally photos of the card front and back.

The malware has RAT features: SMS interception, forwarding and sending, call forwarding, overlay-based card theft, and abuse of SMS-read, call-log, phone-state, device-admin and Accessibility permissions. All seven families carry SMS interception, call forwarding, phishing overlay and cryptojacking capability per Group-IB's family table. Some builds include an XMRig-based cryptominer reaching pool.fud2026.com and pool-proxy.fud2026.com on port 9000. Group-IB describes wake locks, a foreground service with notification channels, battery-optimization exemption requests and a silent audio loop for persistence, and AES/CBC/PKCS5Padding encryption for payload delivery. C2 runs over three channels: Telegram bots (emoji-formatted messages), Firebase Realtime Database and remote HTTP servers (endpoints such as /api/add_sms.php and /message.php). GhostBat uses Firebase and Telegram, cyb3rx uses Telegram plus remote servers, d-passive, godz and tenxen use Firebase, and d-shine and appkjl use remote servers. Sample commands include call_forward_activate/deactivate, set_sms_forwarding, custom_ussd, get_device_info and send_sms (cyb3rx); checkLiveness, callForward, smsForward, KeyLogger and sendSms (GhostBat); and enableCallForwarding, disableCallForwarding, forwardSms and checkCallForwarding (tenxen). The cyb3rx family includes a GitHub-hosted admin controller APK for operators.

Group-IB found evidence that the operators build and edit malware on Android devices, citing AIDE IDE, MT Manager, Acode, Apktool M, Firebase configuration files and .java sources, with developer screenshots shared on Telegram dating to 2024. Of the 17,960 devices, 2,364 are unique devices confirmed by UUID and 15,596 were identified through Firebase; 7,611,443 SMS messages were intercepted. Group-IB reported the identified GitHub profiles and repositories for deactivation. No CVE is involved, and no nation-state attribution is stated in the source.

## MITRE ATT&CK

- T1660 Phishing
- T1566.004 Phishing: Spearphishing Voice
- T1566.002 Phishing: Spearphishing Link
- T1583.001 Acquire Infrastructure: Domains
- T1608.001 Stage Capabilities: Upload Malware
- T1544 Ingress Tool Transfer
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1406 Obfuscated Files or Information
- T1417.002 Input Capture: GUI Input Capture
- T1417.001 Input Capture: Keylogging
- T1636.004 Protected User Data: SMS Messages
- T1517 Access Notifications
- T1426 System Information Discovery
- T1582 SMS Control
- T1616 Call Control
- T1481 Web Service
- T1437.001 Application Layer Protocol: Web Protocols
- T1571 Non-Standard Port
- T1646 Exfiltration Over C2 Channel
- T1541 Foreground Persistence
- T1496.001 Resource Hijacking: Compute Hijacking

## Sources

- [False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps](https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/)
- [GhostBat RAT: Inside the Resurgence of RTO-Themed Android Malware (Cyble)](https://cyble.com/blog/ghostbat-rat-inside-the-resurgence-of-rto-themed-android-malware/)
- [Rapid Response: Zimperium's Zero-Day Coverage of GhostBat RAT Campaign](https://zimperium.com/blog/rapid-response-zimperiums-zero-day-coverage-of-ghostbat-rat-campaign)
- [GhostBat RAT Malware Targets Indian Users Through Fake RTO Apps](https://www.mobileidworld.com/ghostbat-rat-malware-targets-indian-users-through-fake-rto-apps/)
- [Reemergent GhostBat RAT malware targets India (SC Media)](https://www.scworld.com/brief/reemergent-ghostbat-rat-malware-targets-india)
- [GhostBat Android RAT Targets 60 Indian Banking and UPI Apps](https://dailysecurityreview.com/?p=44676)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4625