A widespread malware operation has compromised nearly 18,000 Android smartphones in India, harvesting more than 7.6 million SMS messages over the past year. This banking Trojan campaign, dubbed “CyberDakait,” has targeted the country’s financial institutions since mid-2025, pulling in data like one-time passwords, bank statements, ID documents, and more—all under the radar via phishing sites, fake apps, and stealthy trojan families.
What the attack looks like
Researchers traced the infections to two discovery methods: 2,364 devices tied to direct notifications from installed apps, and another 15,596 identified through exposed Firebase backend infrastructure. Altogether, 17,960 Android phones were compromised. Collected SMSs—7,611,443 in total—included verification codes, transaction alerts, and general communications that enable unauthorized account access and fraud.
The attackers impersonated 11 major banks and two government schemes to extract financial data, credit card details, and identity proofs. They begin with a cold call after a target receives a new card—posing as a bank rep claiming a “Credit Card Protection Plan” is active. Victims are tricked into canceling it via a link (often sent through WhatsApp), which leads them to phishing banking portals hosting APK files. Installing one fake app kicks off a chain: a bogus Play Store update prompt, followed by hidden credential and identity theft routines.
Malware families and techniques
This campaign involves seven distinct Trojan families linked under CyberDakait: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat (previously known under a different alias), and tenxen. Each family shares some tactics—SMS theft, message relaying, and harvesting banking logins—but differ in technical details such as network behavior, database layout, and command response. Almost all of them redirect intercepted SMS data to remote services: Telegram bots, Firebase, or custom servers.
One family, d-miner, stands out by combining data theft with illicit cryptocurrency mining using the XMRig engine. To maintain persistence, many samples disable Android’s battery optimization, use wake locks, or play silent audio—keeping malicious services alive in the background. Researchers also uncovered an admin app for cyb3rx that gives operators remote control over infected devices: reading messages, managing device settings, toggling call forwarding, extracting photos and documents.
Timeline, exposure, and defense
The malware campaign has been active since January 2025, with technical evidence showing its financial services targets emerging around July 2025. Its infrastructure included phishing domains (such as cancelcardprotection[.]online, servicecpp[.]in, etc.), compromised GitHub repos hosting dropper apps, and distinct server endpoints. Authorities have since shut down many of the GitHub accounts involved.
Users are urged to stay vigilant: don’t install apps from unknown sources, avoid links sent via phone calls demanding urgent financial actions, review app permissions—especially SMS and device administration—and check phone & browser settings. If you suspect your device is compromised, immediate steps include freezing bank accounts and contacting your institution.
This operation matters because it combines several attack vectors—phishing, malicious apps, SMS interception, data exfiltration, and even crypto mining—under a single umbrella. At scale, this shows how sophisticated mobile malware ecosystems have become, especially where trust in remote verification processes is weak. Watch for updates from banks, call fraud alerts, and always verify that any financial or identity demand comes from a legitimate source. As security teams scramble to respond, the evolving nature of CyberDakait sets a worrying precedent for Android’s threat landscape.
