Mr Robot gang rents malware-as-a-service to drain Indian bank accounts

How the Mr Robot gang operates

CloudSEK, a cybersecurity firm based in New Delhi, has identified a cyber criminal gang operating under the name Mr Robot. The group provides malware-as-a-service (MaaS) specifically designed to target customers of Indian banks. According to CloudSEK’s findings, Mr Robot rents out technical tools, including an admin app and crimeware platforms, to fraudsters who install malicious apps on victims’ mobile phones.

The malware deployed by the gang steals one-time passwords (OTPs), forwards calls to fraudsters’ numbers, and collects sensitive information such as Aadhaar, PAN, card details, ATM PINs, UPI PINs, and net-banking credentials. To evade detection, the malware remains dormant for at least 48 hours after installation and uses a new digital signature for each copy distributed.

Fake apps and data theft tactics

The Mr Robot gang’s platform includes about 36 lure apps, nine of which mimic public- and private-sector banks. Other fake apps impersonate utility bill payment portals for gas, water, and electricity, as well as traffic-fine payment pages for Regional Transport Offices (RTOs). These apps charge a small fee—typically ₹9 to ₹10—to collect personal details like PAN numbers.

Data from exposed affiliate databases reveals the scale of the operation. One affiliate had infected 154 phones and intercepted 3,270 SMS messages, while another recorded 153 infections and 5,407 intercepted messages as of July 30, 2026. In total, the two affiliates accounted for over 300 infected devices and nearly 9,000 stolen messages, including OTPs from more than a dozen banks and payments banks.

Call forwarding was active on 58% of the victims in one affiliate’s database, allowing fraudsters to intercept bank communications. A separate wave of infections in May saw 149 phones compromised in a single burst.

Who is being targeted

Most victims are users of budget Android phones with SIMs from major Indian carriers, including Airtel, Jio, Vi, and BSNL. The widespread use of affordable devices and reliance on OTP-based authentication make this demographic particularly vulnerable to such attacks.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Mr Robot’s model—malware-as-a-service with a focus on Indian banking customers—lowers the barrier for entry into cybercrime. Founders and operators in India’s fintech and digital banking space should note that attackers are not just stealing credentials but also exploiting call-forwarding features to bypass OTP protections. The use of fake utility apps and traffic-fine payment pages demonstrates how attackers leverage routine transactions to gain trust. For security teams, the malware’s dormancy and unique signatures highlight the need for runtime detection capabilities that can identify threats even after they clear initial security checks.

Key takeaways

• Indian fintech founders and operators must prioritize OTP and SMS security, as this campaign exploits weaknesses in two-factor authentication and call-forwarding features.
• The use of fake utility apps (gas, water, electricity) and traffic-fine payment pages highlights how attackers exploit everyday transactions to trick users.
• The malware’s evasion tactics—dormancy and unique signatures—signal the need for runtime threat detection in mobile security strategies.

Related on Lazyfounder

• More technology news