MR ROBOT Malware-as-a-Service Targets Indian Bank Customers
A new Android malware-as-a-service (MaaS) operation, dubbed MR ROBOT, is renting customized banking trojans to criminals targeting Indian bank customers, with one affiliate intercepting over 5,400 text messages.
A sophisticated malware-as-a-service (MaaS) operation, identified as MR ROBOT, has emerged, offering customized Android banking trojans to threat actors specifically targeting customers of Indian financial institutions. This multi-tenant crimeware platform operates like a subscription service, allowing affiliates to generate their own bank-themed malware through a dedicated builder and control panel.
The MR ROBOT operators provide a Telegram-based storefront, named APK Shield, which lists approximately 36 lure applications. These fake apps impersonate various entities, including major Indian banks, utility providers, and government services, aiming to trick users into downloading malicious software. The distribution methods include fake app stores and links shared via messaging applications.
Once installed, the MR ROBOT malware is designed to harvest sensitive banking information. It intercepts one-time passwords (OTPs) sent via SMS, displays fake login screens to capture banking credentials, card details, and personal identification numbers. A particularly concerning feature is its ability to silently enable call forwarding, rerouting incoming calls, including crucial bank fraud-check callbacks, to numbers controlled by the attackers.
Research by CloudSEK detailed the operation, noting that MR ROBOT is not a singular campaign but a platform supporting multiple affiliates. Each affiliate receives a unique application ID and can create Android packages tailored to impersonate specific Indian banks. The platform also supports a tiered reseller model, with sub-admin accounts and time-limited licenses managed through a control panel identified as version 7.0.
Evidence of the operation's scale was observed through the data collected by two tracked affiliates. One affiliate's panel showed around 154 enrolled devices and approximately 3,270 intercepted messages. A second affiliate, linked to an exposed Firebase database, had 153 devices and recorded 5,407 intercepted messages between July 16 and July 30, 2026. A significant portion of these messages originated from bank and telecommunications short codes, highlighting the direct targeting of financial communications.
Further analysis revealed that call forwarding was actively enabled on 58% of the monitored devices, indicating a widespread use of this feature to intercept communications. Each malware build is equipped with a fresh signing certificate and can conceal itself from the Android launcher post-installation, making detection more challenging.
CloudSEK noted similarities in call forwarding and per-customer builder functionalities with previously documented operations like FatBoyPanel and RedWing. However, the specific kit, storefront, and control panel used by MR ROBOT had not been publicly reported before this research. This indicates a potentially new or evolving MaaS offering in the cybercriminal ecosystem.
To mitigate these threats, CloudSEK advises users to exercise extreme caution and avoid installing bank-related applications from links received via text, WhatsApp, or Telegram. They also recommend that banks transition customers away from SMS-based OTP authentication towards more secure methods like app-based authentication or FIDO standards where feasible.