A new Android malware-as-a-service operation called MR ROBOT is renting customized banking trojans to criminals who target Indian bank customers, according to research published October 28 by CloudSEK. The report says one affiliate intercepted 5,407 text messages from 153 infected devices.
CloudSEK found an operator control panel, a Telegram-based storefront and a malware builder. Affiliates use these to create bank-themed Android trojans on demand. The lures are distributed through fake Play Store-style pages and messaging-app links, and they impersonate banks, utility providers and government services.
CloudSEK describes MR ROBOT as a multi-tenant crimeware platform rather than a single actor's campaign. Each affiliate receives its own application ID and can generate packages impersonating specific Indian banks. The platform uses a tiered reseller model with sub-admin accounts, and access is licensed for set periods through a control panel identified as version 7.0.
According to the report, the malware intercepts one-time passwords (OTPs) in text messages, shows fake screens to harvest banking credentials, card details, PINs and identity information, and can silently enable call forwarding. CloudSEK said this reroutes incoming calls, including banks'