Full Report
Our zLabs research team has discovered a mobile malware campaign consisting of almost 900 malware samples primarily targeting users of Indian banks. The post Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach appeared first on Zimperium.
Analysis Summary
# Incident Report: Massive Android Banker Trojan Campaign Targeting Indian Financial Users
## Executive Summary
A large-scale, coordinated mobile malware campaign, dubbed "FatBoyPanel," was discovered targeting Android users in India with the goal of stealing banking credentials and One-Time Passwords (OTPs). The threat actor utilized Trojan Bankers distributed via WhatsApp, which leveraged SMS interception and, in some cases, exfiltrated data to publicly accessible Firebase storage buckets, exposing data from an estimated 50,000 users. The campaign was identified through on-device detection, revealing a sophisticated infrastructure that included hardcoded exfiltration numbers and unsecured command-and-control (C&C) dashboards.
## Incident Details
- **Discovery Date:** February 5, 2025 (Date of research publication)
- **Incident Date:** Ongoing campaign identified prior to publication.
- **Affected Organization:** Approximately 50,000 individual mobile users (implied).
- **Sector:** Financial Services/Banking (Targeting users of Indian banks).
- **Geography:** India (Attacker phone numbers primarily linked to West Bengal, Bihar, and Jharkhand).
## Timeline of Events
### Initial Access
- **Date/Time:** Not explicitly stated, part of an ongoing campaign.
- **Vector:** Distribution via **WhatsApp** as APK files disguised as legitimate government or banking applications.
- **Details:** Users were tricked into installing the malicious APKs, which requested broad permissions.
### Lateral Movement
- **Details:** The malware focused on exploiting device permissions rather than traditional network lateral movement. It used **GUI Input Capture** to steal credentials displayed on screen overlays (e.g., banking PINs/patterns) and intercepted SMS messages for OTP theft.
### Data Exfiltration/Impact
- **Details:** Stolen data (SMS messages, bank details, card info, Aadhar/PAN details) was exfiltrated via three main methods:
1. Forwarding SMS to an attacker-controlled phone number.
2. Exfiltrating data to an unsecured, publicly accessible **Firebase endpoint**.
3. A hybrid approach combining both.
- Over 2.5GB of sensitive data was found exposed across 222 Firebase buckets.
### Detection & Response
- **How it was discovered:** Zimperium’s dynamic, on-device detection engine successfully identified multiple instances of the specialized Trojan Banker malware.
- **Response actions taken:** Researchers identified approximately 1,000 phone numbers used in the campaign and intend to share this information with authorities upon request.
## Attack Methodology
- **Initial Access:** Phishing (T1660) via social engineering on WhatsApp.
- **Persistence:** Event Triggered Execution using Broadcast Receivers to monitor SMS and outgoing calls (T1624.001). Hiding the application icon and resisting uninstallation.
- **Privilege Escalation:** Not explicitly described, but full SMS access was obtained, allowing control over crucial security functions (OTPs).
- **Defense Evasion:** Code obfuscation and packing techniques were used to hinder reverse engineering.
- **Credential Access:** GUI Input Capture (T1417.002) to steal credentials displayed on screen overlays mimicking banking apps, and direct SMS theft for OTPs (T1635).
- **Discovery:** System Information Discovery (T1426) to gather device details (like androidID).
- **Lateral Movement:** Not applicable in the traditional sense; the focus was internal device compromise.
- **Collection:** Input Capture (T1417.002), Contact List export (T1636.003), and SMS Message exfiltration (T1636.004).
- **Exfiltration:** Exfiltration Over Alternative Protocol (T1639.001) to hardcoded phone numbers or unsecured Firebase endpoints.
- **Impact:** Input Injection (T1516) by displaying overlay screens (fake PIN entry screens) and SMS Control (T1582) to facilitate unauthorized transactions.
## Impact Assessment
- **Financial:** Unauthorized financial transactions likely occurred due to OTP/credential theft.
- **Data Breach:** 2.5GB of sensitive data potentially exposed, impacting an estimated 50,000 users, including bank SMS, card details, Aadhar, and PAN card information.
- **Operational:** Direct operational disruption was focused on the victims' personal banking security rather than organizational infrastructure.
- **Reputational:** Damage to the trust in banking apps and government communications credibility within India. Furthermore, the attackers' own C&C infrastructure suffered a public exposure due to unsecured Firebase buckets.
## Indicators of Compromise
- **Network indicators:** Unsecured Firebase endpoints used for exfiltration (Specific URLs defanged and shared with authorities). Dynamically resolved C&C endpoints using websocket communication.
- **File indicators:** Nearly 900 similar APK malware samples sharing code structures.
- **Behavioral indicators:** Exploitation of SMS permissions, creating overlay UIs that mimic banking login screens, and forwarding SMS to specific hardcoded or dynamically assigned phone numbers.
## Response Actions
- **Containment measures:** No immediate organizational containment, as this was a third-party research discovery. Zimperium contained the threat by analyzing the samples and documenting the infrastructure.
- **Eradication steps:** Not applicable for external researchers; eradication relies on users uninstalling the application and banks issuing warnings.
- **Recovery actions:** Sharing discovered IoCs and phone numbers with relevant law enforcement agencies.
## Lessons Learned
- **Key takeaways:** Threat actors are increasingly using social engineering via widely trusted platforms (WhatsApp) and leveraging multi-layered exfiltration methods (SMS forwarding and cloud storage) to bypass traditional network monitoring. The exposure of the attacker’s C&C infrastructure via unsecured Firebase buckets demonstrates poor operational security on the threat actor's side.
- **What could have been done better:** Users need stronger security awareness regarding sideloading APKs from untrusted sources, especially those claiming to be government or banking related. Mobile security solutions emphasizing on-device behavior detection are critical for catching this type of advanced Trojan.
## Recommendations
- **Prevention measures for similar incidents:**
1. Implement robust Mobile Threat Defense (MTD) solutions capable of dynamic, on-device analysis to detect overlay attacks and SMS permission abuse.
2. Users should strictly avoid installing applications from sources outside official app stores, particularly those received via messaging apps like WhatsApp.
3. Banks should educate customers on the specific phishing tactics used, particularly the danger of SMS OTPs and PIN entry prompts occurring simultaneously.
4. Organizations managing cloud storage (like Firebase) must enforce strict authentication and access controls on all storage buckets to prevent data leakage incidents caused by misconfiguration.