Thursday, May 1, 2025
HomeCyber Security NewsBeware of Fake Indian Rewards Apps That Installs Malware on Your Devices

Beware of Fake Indian Rewards Apps That Installs Malware on Your Devices

Published on

SIEM as a Service

Follow Us on Google News

Microsoft 365 Defender Research Team analysed the new version of previously reported info-stealing Android malware, delivered through an SMS campaign. This new version has remote access trojan (RAT) capabilities, targeting the customers of Indian banks.

The Message contains links that points to the info-stealing Android malware, leading the user to download a fake banking rewards app.

The SMS Campaign Attack Flow

Researchers say, the fake app, detected as [TrojanSpy:AndroidOS/Banker.O], used a different bank name and logo compared to a similar malware reported in 2021.

- Advertisement - Google News

“The malware’s RAT capabilities allow the attacker to intercept important device notifications such as incoming messages, an apparent effort to catch two-factor authentication (2FA) messages often used by banking and financial institutions”, Microsoft

This diagram illustrates the typical infection chain of this Android malware. The infection starts from an SMS message that contains a malicious link that leads to the malicious APK.
SMS Campaign Attack Flow

The command and control (C2) server is linked to 75 different malicious APKs, all of which are based on open-source intelligence. 

The research team identified many other campaigns targeting Indian bank customers, including:

  • Axisbank_rewards[.]apk
  • Icici_points[.]apk
  • Icici_rewards[.]apk
  • SBI_rewards[.]apk

While researching on icici_rewards[.]apk, it presents itself as ICICI Rewards. Initially, this SMS campaign sends messages that contain a malicious link, leading to install malicious APK on a target’s mobile device.

“To lure users into accessing the link, the SMS claims that the user is being notified to claim a reward from a known Indian bank”, Microsoft Researchers.

Screenshot of the SMS message received. The message contains a link and mentions the name of a legitimate India-based bank.

Upon user interaction, it displays a splash screen with the bank logo and proceeds to ask the user to enable specific permissions for the app.

Screenshots of the fake app installed on the mobile device and where it states the Android permissions it needs to be enabled. The app uses an India-based bank's logo to appear legitimate.App installed on the Android device, Asks users to enable permissions on text messaging and contacts

It also requests users to enter their credit/debit card information as part of a supposed sign-in process, while the trojan waits for further instructions from the attacker.

These commands let the malware to collect system metadata, call logs, intercept phone calls, and steal credentials for email accounts such as Gmail, Outlook, and Yahoo.

“This malware’s new version adds several RAT capabilities that expands its information stealing. It enables the malware to add call log uploading, SMS message and calls interception, and card blocking checks”, Microsoft

Mitigation

  • Download and install applications only from official app stores.
  • Android device users can keep the Unknown sources option disabled to stop app installation from unknown sources.
  • Use mobile solutions such as Microsoft Defender for Endpoint on Android to detect malicious applications.

Download Free SWG – Secure Web Filtering – E-book

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Netgear EX6200 Flaw Enables Remote Access and Data Theft

Security researchers have disclosed three critical vulnerabilities in the Netgear EX6200 Wi-Fi range extender...

Tesla Model 3 VCSEC Vulnerability Lets Hackers Run Arbitrary Code

A high security flaw in Tesla’s Model 3 vehicles, disclosed at the 2025 Pwn2Own...

Quantum Computing and Cybersecurity – What CISOs Need to Know Now

As quantum computing transitions from theoretical research to practical application, Chief Information Security Officers...

Apache ActiveMQ Vulnerability Lets Remote Hackers Execute Arbitrary Code

A high vulnerability in Apache ActiveMQ’s .NET Message Service (NMS) library has been uncovered,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Netgear EX6200 Flaw Enables Remote Access and Data Theft

Security researchers have disclosed three critical vulnerabilities in the Netgear EX6200 Wi-Fi range extender...

Tesla Model 3 VCSEC Vulnerability Lets Hackers Run Arbitrary Code

A high security flaw in Tesla’s Model 3 vehicles, disclosed at the 2025 Pwn2Own...

Apache ActiveMQ Vulnerability Lets Remote Hackers Execute Arbitrary Code

A high vulnerability in Apache ActiveMQ’s .NET Message Service (NMS) library has been uncovered,...