CyberDakait Hackers Target Indian Banking Users, Compromise 17,960 Android Devices

CyberDakait, a financially motivated Android malware operation targeting Indian banking customers since July 2025.

Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages, exposing a campaign that combines banking credential theft, remote device control, and cryptocurrency mining.

Although their technical implementations differ, Group-IB clusters them together because of overlapping distribution methods, phishing infrastructure, and financial objectives.

Victims receive fraudulent calls and messages from attackers posing as bank representatives. A recurring pretext involves canceling an allegedly activated Credit Card Protection Plan.

Callers threaten impending charges and direct customers to phishing websites, where cancellation supposedly requires installing an Android application.

Bank-themed pages distribute malicious APKs through GitHub repositories, exploiting the platform’s legitimate reputation.

After installation, a counterfeit Google Play update interface encourages deployment of another payload. Requests to turn off battery optimization help malicious services remain active despite Android’s background execution restrictions.

The phishing workflow progressively collects card numbers, expiry dates, CVVs, internet banking credentials, card grid values, identity details, and photographs.

Combined with intercepted authentication messages, these records give operators the information needed to attempt unauthorized transactions and account compromise.

The initial application acts as a dropper, delivering remote-access functionality alongside an XMRig-based mining component.

Group-IB describes encrypted payload delivery using AES/CBC/PKCS5Padding, with wake locks, silent audio playback, and foreground services supporting persistence.

Group-IB Researchers said that, the operation impersonates 11 Indian banking institutions and two government programs. Seven malware families underpin its infrastructure: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat, and tenxen.

Indian Banking Users Targeted

Related Seqrite research documented d-miner downloading encrypted native libraries and mining Monero while devices were locked.

Mining stopped when users unlocked their phones, reducing visible disruption while retaining access to idle processing resources.

Group-IB also connects GhostGrab to an older GhostBat version, tracking both as one family.

Earlier Cyble analysis documented GhostBat spreading through fake transport applications, while CYFIRMA’s GhostGrab investigation described banking-themed WebViews, Firebase exfiltration, SMS interception, and covert mining.

These reports provide technical context, rather than independently establishing CyberDakait attribution.

Researchers identified 2,364 unique device UUIDs within 2,805 installation notifications. Exposed Firebase infrastructure revealed another 15,596 compromised devices, producing the reported combined total of 17,960.

Repeat installation notifications were distinguished from unique devices rather than counted as separate victims.

Intercepted messages included OTPs, transaction alerts, and other account communications.

Stolen records also contained PAN and Aadhaar information, increasing identity exposure beyond immediate payment fraud.

The families use Telegram bots, Firebase databases, and remote HTTP backends for registration, exfiltration, and command delivery.

Differences in database schemas, command names, and telemetry formats underpin Group-IB’s decision to maintain separate malware classifications.

A GitHub-hosted cyb3rx administrative APK exposed an operator dashboard supporting victim monitoring, SMS forwarding, call-forwarding commands, and remote SMS transmission.

Screenshots associated with GhostBat development also showed Android-based coding and APK modification tools.

For defenders, the campaign highlights the importance of identifying suspicious APK installations, unexpected SMS permissions, counterfeit update screens, and persistent background services.

Users should obtain banking applications through verified channels and contact their banks immediately after suspected exposure.

Related vendor guidance recommends reviewing permissions, enabling Play Protect, and investigating unexplained overheating or battery drain.

Indicators of Compromise

Category	Indicator
Phishing domain	81service[.]icu
Phishing domain	81service[.]in
Phishing domain	Imanagec[.]online
Phishing domain	applypointguides[.]in
C2 IP address	64.89.163[.]3
C2 IP address	78.159.156[.]74
C2 IP address	144.31.244[.]184
C2 IP address	46.151.182[.]28

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.