MR ROBOT Android Banking Malware Uses Fake KYC Apps to Steal OTPs in India

An urgent message asking you to update KYC or verify Aadhaar may seem routine. But installing an app sent through a message can expose your banking details. A recently reported Android malware operation, called MR ROBOT, uses fake apps to target Indian bank customers.

The operation works like a rental service for cybercriminals. Its customers can create convincing apps that imitate banks and services such as Aadhaar updates, utilities and traffic challans, then share them through SMS or messaging apps. The apps may show fake forms to collect details such as Aadhaar and PAN information, card numbers, PINs and net-banking credentials.

The malware can also read SMS messages, including OTPs, and redirect incoming calls. That could prevent a bank’s verification call from reaching the customer. The reported investigation found examples of infected devices and intercepted messages, but those figures came from individual accounts and do not establish the operation’s total reach or financial losses.

Do not install banking, KYC or government-service apps from links or files sent in messages. Use official app stores or verified service channels, and be cautious when an app requests SMS or call permissions it does not need. Never share an OTP, PIN or CVV. If you installed a suspicious app, contact your bank promptly and report suspected financial cybercrime through 1930 or cybercrime.gov.in.