Full Report
Our zLabs research team has discovered a mobile malware campaign consisting of almost 900 malware samples primarily targeting users of Indian banks. The post Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach appeared first on Zimperium.
Analysis Summary
# Incident Report: Massive Mobile Banking Trojan Heist Targeting Indian Users
## Executive Summary
A sophisticated, coordinated mobile malware campaign, dubbed "FatBoyPanel," was discovered, primarily targeting Android users in India with the intent of stealing banking credentials and sensitive personal data. The threat actor utilized banking-themed Trojan apps distributed via WhatsApp, leveraging SMS interception and insecure Firebase storage to exfiltrate data from an estimated 50,000 users. The incident was exposed through independent security research, leading to the identification of exposed configuration data and C2 infrastructure.
## Incident Details
- **Discovery Date:** February 5, 2025
- **Incident Date:** Ongoing campaign discovered prior to this date.
- **Affected Organization:** Estimated 50,000 individual users across multiple Indian financial institutions.
- **Sector:** Financial Services/Mobile Banking Users
- **Geography:** India (Attackers traced primarily to West Bengal, Bihar, and Jharkhand).
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-February 5, 2025 (Ongoing campaign)
- **Vector:** Phishing via WhatsApp distribution of malicious APK files.
- **Details:** Malware was disguised as legitimate government or banking applications.
### Lateral Movement
*This incident focused primarily on device compromise and data exfiltration rather than internal network lateral movement.*
- **Details:** Malware exploited SMS permissions to intercept OTPs and used application overlay techniques to mimic banking login screens for credential capture.
### Data Exfiltration/Impact
- **Details:** Stolen data included SMS messages (including OTPs), Aadhar Card details, PAN Card details, credit/debit card information, ATM PINs, and mobile banking credentials. Data was exfiltrated to hardcoded phone numbers or, in some variants, to unsecured Firebase storage buckets (resulting in 2.5GB of exposed data).
### Detection & Response
- **Detection:** Discovered through dynamic, on-device detection by the zLabs research team, identifying the samples as Trojan Bankers.
- **Response Actions:** Researchers compiled IOCs and analyzed the 1,000+ collected samples. Phone numbers used for SMS forwarding were identified for sharing with law enforcement. The exposed Firebase endpoints were identified and analyzed.
## Attack Methodology
- **Initial Access:** Phishing (T1660) via malicious APK distribution over WhatsApp, masquerading as legitimate apps.
- **Persistence:** Event Triggered Execution via Broadcast Receivers to monitor SMS and outgoing calls (T1624.001).
- **Privilege Escalation:** Not explicitly detailed for OS privilege, but the malware immediately abuses critical Android permissions (SMS access).
- **Defense Evasion:** Code obfuscation and packing techniques were used to complicate reverse engineering. The application hid its icon.
- **Credential Access:** GUI Input Capture (T1417.002) to steal details displayed on a fake overlay, and stealing OTPs (T1635).
- **Discovery:** System Information Discovery (T1426) to gather device details like androidID.
- **Lateral Movement:** N/A (Targeted endpoints were individual mobile devices).
- **Collection:** Exfiltration of Contact List (T1636.003) and SMS Messages (T1636.004), including OTPs.
- **Exfiltration:** Exfiltration Over Unencrypted Non-C2 Protocol (T1639.001) to hardcoded phone numbers or Firebase endpoints.
- **Impact:** Input Injection (T1516) via overlay attacks, and local SMS control (T1582) to facilitate unauthorized transactions.
## Impact Assessment
- **Financial:** Potential for unauthorized transactions across compromised user accounts.
- **Data Breach:** Exposure of sensitive PII (Aadhar, PAN cards), financial credentials (Card details, PINs, OTPs) for an estimated 50,000 users. 2.5 GB of data was publicly accessible via misconfigured Firebase.
- **Operational:** Direct impact on banking operations via fraudulent transactions, lack of trust in mobile channels for affected users.
- **Reputational:** Damage to the reputation of targeted banks and government assurances regarding mobile security.
## Indicators of Compromise
- **Network Indicators:** Data exfiltrated via hardcoded phone numbers or unsecured Firebase endpoints (specific IPs/URLs removed for safety).
- **File Indicators:** Nearly 900 unique malware samples sharing common characteristics (APK format, specific UI elements).
- **Behavioral Indicators:** SMS interception, dynamic HTML payload fetching via websockets (T1481.002), and hiding the application icon.
## Response Actions
- **Containment:** Researchers analyzed traffic patterns and exposed C2 infrastructure (including insecure Firebase buckets and hardcoded phone numbers).
- **Eradication:** The findings (IOCs, exposed C2 dashboards/credentials) are intended to be shared with relevant authorities for disruption.
- **Recovery:** Users must manually uninstall the applications, change all associated credentials, and monitor financial accounts.
## Lessons Learned
- **Trust Exploitation:** Attackers successfully capitalized on the established trust in major Indian banks and government agencies to drive distribution.
- **Pervasive Misconfiguration Risk:** The reliance on Firebase storage without authentication led to a significant, accidental public data exposure (2.5GB), demonstrating a critical supply chain/configuration risk alongside malware execution.
- **Layered Theft:** The malware combined classic overlay attacks with SMS interception (OTPs), making standard multi-factor authentication insufficient protection against this specific threat.
## Recommendations
- **Enhanced Distribution Verification:** Financial institutions and government bodies should issue immediate, high-profile warnings specifically detailing the fraudulent WhatsApp APK distribution methods.
- **Secure Cloud Practices:** Organizations utilizing Firebase or similar cloud storage solutions must rigorously audit all storage buckets for public accessibility and enforce mandatory authentication/authorization layers.
- **Proactive Mobile Defense:** Users should utilize mobile threat defense solutions capable of runtime analysis and application behavior monitoring, as signature-based AV failed in some instances.
- **SMS Permission Auditing:** Android devices should be audited for applications holding SMS permissions unnecessarily, as this is the core mechanism enabling OTP theft.