The MR ROBOT operation shows how far criminal software has moved past the single phishing site. According to CloudSEK, the platform is a multi-tenant malware-as-a-service product: affiliates receive their own application ID, generate Android packages impersonating specific Indian banks, and license access through a control panel identified as version 7.0. A tiered reseller model with sub-admin accounts means the attack is run as a business, with customers, support and pricing, rather than improvised by one group.
What makes the kit dangerous is not any one feature but the combination. The malware intercepts one-time passwords from text messages, displays fake screens to harvest banking credentials, card details, PINs and identity information, and can silently enable call forwarding. CloudSEK said that forwarding reroutes incoming calls, including a bank's fraud-check callback, to a number the attackers control. In other words, the malware does not merely steal a code; it also disables the call a customer would make to verify a suspicious transaction.
The scale is hard to dismiss. CloudSEK tracked two affiliates, one with about 154 enrolled devices and roughly 3,270 intercepted messages, and another linked to an exposed Firebase database that showed 153 devices and 5,407 messages. The data covered July 16 to 30, 2026, and about 4,000 of the messages came from bank and telecommunications short codes. CloudSEK reported call forwarding active on 58% of the devices. Those are the figures the researchers reported, and they are alarming even as a snapshot of two affiliates.
Responsibility does not rest only with the criminals. The lures, which include fake Play Store-style pages and bank, utility and government impersonations, depend on customers installing apps from links sent by text, WhatsApp or Telegram. CloudSEK's advice to avoid bank-branded apps from such links is correct, but it is advice customers can only follow if the institutions they bank with make the legitimate channel obvious and reduce their reliance on SMS codes. Banks should move customers toward app-based authentication and FIDO-style methods where feasible, as CloudSEK urged, and should stop treating an SMS as proof of identity.