False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps

    Thursday, October 29, 2026 In: Threat Research Print

    Date: 10/29/2026

    Severity: High

    Summary

    The financially motivated threat cluster CyberDakait has been targeting India’s financial services sector since July 2025 using seven Android malware families distributed through smishing and vishing campaigns impersonating bank representatives. The malware uses fake applications and overlay attacks to steal mobile banking credentials, credit card details, and other sensitive information, while also deploying cryptocurrency-mining modules for additional revenue. The campaign has impersonated 11 Indian banks and two government programs, compromised at least 17,960 devices, and intercepted approximately 7.6 million SMS messages. Organizations and users should avoid installing APKs from untrusted sources, verify banking communications, and use trusted mobile security protections.  

    Indicators of Compromise (IOC) List

    Domains/URLs

    81service.icu

    81service.in

    Imanagec.online

    applypointguides.in

    cancelcardprotection.online

    cancelcpservice.in

    cancelmyservice.in

    cancelservice.in

    cardforex.icu

    cardplan.online

    cardprotections.in

    cardsprotection.in

    cardsprotection.online

    careidf.online

    carep.online

    cpmanaged.in

    cppmanage.in

    deactivatecpplan.in

    deactivatecpservice.in

    hamzaansari1612-ux.github.io

    hdmanage.online

    icppuser.in

    icppuser.online

    icservice.online

    icuser.online

    idcare.in

    idfcare.in

    idmanagecp.online

    idservice.in

    imobile.services

    imobilelite.in

    imobileservices.online

    indeemanage.in

    indemanage.in

    indiuser.com

    inducare.online

    managebworld.com

    managecare.in

    managecare.online

    managecp.co.in

    managecp.com

    manageici.com

    manageinsurances.online

    manageprotection.in

    manageprotectionplan.in

    manageprotections.com

    myicuser.in

    myinsuranceservice.in

    mypnhelp.online

    mypolicyservice.in

    pmanage.online

    pncare.online

    policydeactivate.in

    protectcc.online

    protectionmanage.online

    rohansingh253641-spec.github.io

    secureici.online

    servicecpp.in

    serviceic.in

    serviceici.in

    serviceidf.in

    serviceidf.online

    servicescard.online

    serviceshelp.online

    suraj527526-cmyk.github.io

    www.icppuser.online

    www.icuser.online

    www.protectcc.online

    www.secureici.online

    www.servicecpp.com

    www.serviceic.com

    ws://64.89.163.3:8082

    aptabase.fud2026.xyz:8443

    accessor.fud2026.com

    fud2026.com

    pool.fud2026.com:9000

    pool-proxy.fud2026.com:9000

    install-update.xyz

    app2-update2.site

    update-app.online

    IP Address

    64.89.163.3

    78.159.156.74

    144.31.244.184

    46.151.182.28

    64.89.163.4

    Hash

    0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856

    1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624

    2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f

    3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921

    5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4

    5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456

    7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d

    47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112beca186d844a

    65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68

    80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a

    431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa

    902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b

    b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9

    b332fa9c08020fbbc5503091b4f4a61ee66a05a0a76abf9a53db9f3d80c4862a

    c9ead89d1bcb09923e1057bb4617726867154d36932ed1c2f82c2466bf11934c

    c36d2b4480034a409f33cdef8d7c3501e75f14d2c5bd9a914a65fd7f3c47d74a

    c6708166e0a6bf3484200fd6dd1569d89e81c36ffd76ff2ab5820b06fd2d5b54

    cb86017411708eb6e5384fc0288b0ec4692ea45ef38586b7c67f99148e1117c3

    cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7

    cf66a1acebd878d85345377be53ac0b241f517253811ec969c8ff9c751151424

    dfa02773f97f552deb7ff04f5c598a81be4d236fe33adca2a47551485a3aeb2a

    9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8

    1b9052d85e12573b4f64f6a47f64803007b19990def1bc62a865de00149a825e

    5c0f8bca492c9ee79d6bbd7a532945514670321a605002987f69e3331110e447

    53f9fcf3a6fdc59e9a28fd129a32064d78628289eac72d47f53d63cbc434de41

    43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6

    34b75b78b6c575c8a9e71f712be9d90aa35a3a04b48839f86282678107f7876d

    1bfaaa9aed67552a2c368df3f264ef6878a4e7b43468546db77f095517b15b56

    04b35b0c199ef8a13d6ac18dfc6df2ea66a8ed5b6e464dc3a7db0839093882bd

    d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f

    4a17171155997754ad735b460be67e344c5939d9cff498ce1d95bf554b93fc1b

    3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc

    555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd1bdeb843570f

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "managecp.co.in" or url like "managecp.co.in" or siteurl like "managecp.co.in" or domainname like "indemanage.in" or url like "indemanage.in" or siteurl like "indemanage.in" or domainname like "myicuser.in" or url like "myicuser.in" or siteurl like "myicuser.in" or domainname like "manageici.com" or url like "manageici.com" or siteurl like "manageici.com" or domainname like "cancelcardprotection.online" or url like "cancelcardprotection.online" or siteurl like "cancelcardprotection.online" or domainname like "serviceidf.in" or url like "serviceidf.in" or siteurl like "serviceidf.in" or domainname like "manageprotections.com" or url like "manageprotections.com" or siteurl like "manageprotections.com" or domainname like "cardforex.icu" or url like "cardforex.icu" or siteurl like "cardforex.icu" or domainname like "manageinsurances.online" or url like "manageinsurances.online" or siteurl like "manageinsurances.online" or domainname like "serviceici.in" or url like "serviceici.in" or siteurl like "serviceici.in" or domainname like "icppuser.online" or url like "icppuser.online" or siteurl like "icppuser.online" or domainname like "cppmanage.in" or url like "cppmanage.in" or siteurl like "cppmanage.in" or domainname like "cardprotections.in" or url like "cardprotections.in" or siteurl like "cardprotections.in" or domainname like "www.icuser.online" or url like "www.icuser.online" or siteurl like "www.icuser.online" or domainname like "install-update.xyz" or url like "install-update.xyz" or siteurl like "install-update.xyz" or domainname like "servicescard.online" or url like "servicescard.online" or siteurl like "servicescard.online" or domainname like "servicecpp.in" or url like "servicecpp.in" or siteurl like "servicecpp.in" or domainname like "applypointguides.in" or url like "applypointguides.in" or siteurl like "applypointguides.in" or domainname like "cancelmyservice.in" or url like "cancelmyservice.in" or siteurl like "cancelmyservice.in" or domainname like "cpmanaged.in" or url like "cpmanaged.in" or siteurl like "cpmanaged.in" or domainname like "icservice.online" or url like "icservice.online" or siteurl like "icservice.online" or domainname like "accessor.fud2026.com" or url like "accessor.fud2026.com" or siteurl like "accessor.fud2026.com" or domainname like "indeemanage.in" or url like "indeemanage.in" or siteurl like "indeemanage.in" or domainname like "manageprotection.in" or url like "manageprotection.in" or siteurl like "manageprotection.in" or domainname like "mypolicyservice.in" or url like "mypolicyservice.in" or siteurl like "mypolicyservice.in" or domainname like "81service.in" or url like "81service.in" or siteurl like "81service.in" or domainname like "cardsprotection.in" or url like "cardsprotection.in" or siteurl like "cardsprotection.in" or domainname like "pmanage.online" or url like "pmanage.online" or siteurl like "pmanage.online" or domainname like "policydeactivate.in" or url like "policydeactivate.in" or siteurl like "policydeactivate.in" or domainname like "serviceic.in" or url like "serviceic.in" or siteurl like "serviceic.in" or domainname like "cardsprotection.online" or url like "cardsprotection.online" or siteurl like "cardsprotection.online" or domainname like "hamzaansari1612-ux.github.io" or url like "hamzaansari1612-ux.github.io" or siteurl like "hamzaansari1612-ux.github.io" or domainname like "idmanagecp.online" or url like "idmanagecp.online" or siteurl like "idmanagecp.online" or domainname like "myinsuranceservice.in" or url like "myinsuranceservice.in" or siteurl like "myinsuranceservice.in" or domainname like "pncare.online" or url like "pncare.online" or siteurl like "pncare.online" or domainname like "www.serviceic.com" or url like "www.serviceic.com" or siteurl like "www.serviceic.com" or domainname like "idservice.in" or url like "idservice.in" or siteurl like "idservice.in" or domainname like "managebworld.com" or url like "managebworld.com" or siteurl like "managebworld.com" or domainname like "app2-update2.site" or url like "app2-update2.site" or siteurl like "app2-update2.site" or domainname like "icuser.online" or url like "icuser.online" or siteurl like "icuser.online" or domainname like "indiuser.com" or url like "indiuser.com" or siteurl like "indiuser.com" or domainname like "cardplan.online" or url like "cardplan.online" or siteurl like "cardplan.online" or domainname like "81service.icu" or url like "81service.icu" or siteurl like "81service.icu" or domainname like "serviceshelp.online" or url like "serviceshelp.online" or siteurl like "serviceshelp.online" or domainname like "serviceidf.online" or url like "serviceidf.online" or siteurl like "serviceidf.online" or domainname like "www.icppuser.online" or url like "www.icppuser.online" or siteurl like "www.icppuser.online" or domainname like "deactivatecpservice.in" or url like "deactivatecpservice.in" or siteurl like "deactivatecpservice.in" or domainname like "imobileservices.online" or url like "imobileservices.online" or siteurl like "imobileservices.online" or domainname like "imobilelite.in" or url like "imobilelite.in" or siteurl like "imobilelite.in" or domainname like "cancelservice.in" or url like "cancelservice.in" or siteurl like "cancelservice.in" or domainname like "cancelcpservice.in" or url like "cancelcpservice.in" or siteurl like "cancelcpservice.in" or domainname like "careidf.online" or url like "careidf.online" or siteurl like "careidf.online" or domainname like "deactivatecpplan.in" or url like "deactivatecpplan.in" or siteurl like "deactivatecpplan.in" or domainname like "idfcare.in" or url like "idfcare.in" or siteurl like "idfcare.in" or domainname like "managecare.in" or url like "managecare.in" or siteurl like "managecare.in" or domainname like "www.servicecpp.com" or url like "www.servicecpp.com" or siteurl like "www.servicecpp.com" or domainname like "update-app.online" or url like "update-app.online" or siteurl like "update-app.online" or domainname like "hdmanage.online" or url like "hdmanage.online" or siteurl like "hdmanage.online" or domainname like "manageprotectionplan.in" or url like "manageprotectionplan.in" or siteurl like "manageprotectionplan.in" or domainname like "protectionmanage.online" or url like "protectionmanage.online" or siteurl like "protectionmanage.online" or domainname like "www.secureici.online" or url like "www.secureici.online" or siteurl like "www.secureici.online" or domainname like "fud2026.com" or url like "fud2026.com" or siteurl like "fud2026.com" or domainname like "inducare.online" or url like "inducare.online" or siteurl like "inducare.online" or domainname like "carep.online" or url like "carep.online" or siteurl like "carep.online" or domainname like "www.protectcc.online" or url like "www.protectcc.online" or siteurl like "www.protectcc.online" or domainname like "secureici.online" or url like "secureici.online" or siteurl like "secureici.online" or domainname like "icppuser.in" or url like "icppuser.in" or siteurl like "icppuser.in" or domainname like "managecp.com" or url like "managecp.com" or siteurl like "managecp.com" or domainname like "protectcc.online" or url like "protectcc.online" or siteurl like "protectcc.online" or domainname like "managecare.online" or url like "managecare.online" or siteurl like "managecare.online" or domainname like "mypnhelp.online" or url like "mypnhelp.online" or siteurl like "mypnhelp.online" or domainname like "Imanagec.online" or url like "Imanagec.online" or siteurl like "Imanagec.online" or domainname like "idcare.in" or url like "idcare.in" or siteurl like "idcare.in" or domainname like "imobile.services" or siteurl like "imobile.services" or url like "imobile.services" or domainname like "rohansingh253641-spec.github.io" or siteurl like "rohansingh253641-spec.github.io" or url like "rohansingh253641-spec.github.io" or domainname like "suraj527526-cmyk.github.io" or siteurl like "suraj527526-cmyk.github.io" or url like "suraj527526-cmyk.github.io" or domainname like "ws://64.89.163.3:8082" or siteurl like "ws://64.89.163.3:8082" or url like "ws://64.89.163.3:8082" or domainname like "aptabase.fud2026.xyz:8443" or siteurl like "aptabase.fud2026.xyz:8443" or url like "aptabase.fud2026.xyz:8443" or domainname like "pool.fud2026.com:9000" or siteurl like "pool.fud2026.com:9000" or url like "pool.fud2026.com:9000"

    Detection Query 2 :

    dstipaddress IN ("78.159.156.74","46.151.182.28","144.31.244.184","64.89.163.3","64.89.163.4","64.89.163.3") or srcipaddress IN ("78.159.156.74","46.151.182.28","144.31.244.184","64.89.163.3","64.89.163.4","64.89.163.3")

    Detection Query 3 :

    sha256hash IN ("dfa02773f97f552deb7ff04f5c598a81be4d236fe33adca2a47551485a3aeb2a","1b9052d85e12573b4f64f6a47f64803007b19990def1bc62a865de00149a825e","cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7","04b35b0c199ef8a13d6ac18dfc6df2ea66a8ed5b6e464dc3a7db0839093882bd","b332fa9c08020fbbc5503091b4f4a61ee66a05a0a76abf9a53db9f3d80c4862a","1bfaaa9aed67552a2c368df3f264ef6878a4e7b43468546db77f095517b15b56","c36d2b4480034a409f33cdef8d7c3501e75f14d2c5bd9a914a65fd7f3c47d74a","65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68","cf66a1acebd878d85345377be53ac0b241f517253811ec969c8ff9c751151424","b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9","80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a","c9ead89d1bcb09923e1057bb4617726867154d36932ed1c2f82c2466bf11934c","2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f","53f9fcf3a6fdc59e9a28fd129a32064d78628289eac72d47f53d63cbc434de41","7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d","d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f","c6708166e0a6bf3484200fd6dd1569d89e81c36ffd76ff2ab5820b06fd2d5b54","43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6","5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456","cb86017411708eb6e5384fc0288b0ec4692ea45ef38586b7c67f99148e1117c3","902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b","5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4","5c0f8bca492c9ee79d6bbd7a532945514670321a605002987f69e3331110e447","3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921","431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa","47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112beca186d844a","555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd1bdeb843570f","1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624","4a17171155997754ad735b460be67e344c5939d9cff498ce1d95bf554b93fc1b","9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8","3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc","34b75b78b6c575c8a9e71f712be9d90aa35a3a04b48839f86282678107f7876d","0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856")

    Reference:    

    False Protection, Emptied Accounts   


    Tags

    MalwareThreat ActorIndiaFinancial ServicesAndroid MalwareSmishingVishingCredential HarvestingcryptocurrencyGovernment Services and FacilitiesTrojan

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.