Date: 10/29/2026
Severity: Critical
Summary
Researchers uncovered MR ROBOT, an Android Banking Trojan-as-a-Service operation targeting Indian bank customers through fake banking, Aadhaar/KYC update, utility-billing, and government-service applications. The malware steals SMS/OTPs, UPI PINs, card details, and net-banking credentials using phishing overlays and SMS interception, while secretly enabling call forwarding to bypass phone-based authentication checks. Distributed through Telegram and messaging-app lures, the platform uses an affiliate-based model, Firebase for Command-and-Control (C2) and data exfiltration, and anti-analysis techniques to evade detection. One exposed affiliate database contained 5,407 intercepted SMS messages across 153 infected devices.
Indicators of Compromise (IOC) List
Domain/Urls | mr-panel.pages.dev mr-panel-bbv.pages.dev baccha-a07d9-default-rtdb.firebaseio.com trycloudflare.com |
Hash | 8b8e44431aff7fcf38f67ac30d4c63250e51117861635a8510ea1c897df49488
fde290df3f3575e8359044d5489e67ff189132b9d73f4ff90cf33d297eb65a4f
ccd0bb059c9da0afb433effebc3c9ed76751569f5abcd1b34d7fc3dab87fd74b
|
Embedded C2 (Firebase app ID) | 824350586695:android:c02716d6605191a80efe62 |
Embedded C2 (Firebase API key) | AIzaSyAWx5U6Jxp-UaIALR4TDHVQPQTkltH03yE |
Telegram | t.me/MRrobottttt070_bot |
Package | com.apkshield.installer.*, com.godz.myapplication |
Component | ApkShieldVpnService |
App-layer key | X9F3MR2026ADMINVAULTKEY123456789 SKYROBOT2026XORKEY7890123456789A MRROB0T2026CRYPT3DKEY78901234567 |
Tenant/license ID | SKY-APP-2026-X9F3 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "trycloudflare.com" or url like "trycloudflare.com" or siteurl like "trycloudflare.com" or domainname like "mr-panel-bbv.pages.dev" or url like "mr-panel-bbv.pages.dev" or siteurl like "mr-panel-bbv.pages.dev" or domainname like "mr-panel.pages.dev" or url like "mr-panel.pages.dev" or siteurl like "mr-panel.pages.dev" or domainname like "baccha-a07d9-default-rtdb.firebaseio.com" or url like "baccha-a07d9-default-rtdb.firebaseio.com" or siteurl like "baccha-a07d9-default-rtdb.firebaseio.com" |
Detection Query 2 : | sha256hash IN ("ccd0bb059c9da0afb433effebc3c9ed76751569f5abcd1b34d7fc3dab87fd74b","8b8e44431aff7fcf38f67ac30d4c63250e51117861635a8510ea1c897df49488","fde290df3f3575e8359044d5489e67ff189132b9d73f4ff90cf33d297eb65a4f")
|
Reference:
MR ROBOT Malware-as-a-Service Targets Indian Banking Customers