CloudSEK uncovers MR ROBOT banking malware targeting Indians

A new Android malware-as-a-service operation, dubbed MR ROBOT, has been found renting customised banking trojans to criminals targeting Indian bank customers. Investigators from threat intelligence firm CloudSEK said the operation functions as a multi-tenant crimeware platform, with affiliates receiving individual app IDs and the ability to generate bank-impersonating Android packages on demand.

The operation is run via a Telegram-based storefront and a malware builder, with a control panel identified as version 7.0, enabling a tiered reseller model and per‑customer builders. The lures are distributed through fake Play Store–style pages and messaging-app links, impersonating banks as well as utilities and government services.

CloudSEK detailed two affiliates, one with around 154 enrolled devices and roughly 3,270 intercepted text messages, and an exposed Firebase database linked to a second affiliate holding 153 devices and 5,407 messages. The data collection period spanned 16–30 July 2026. The malware intercepts text messages containing OTPs, presents fake screens to harvest credentials, card details, PINs and identity information, and can silently enable call forwarding to reroute fraud-check callbacks.

A notable feature is that each malware build uses a fresh signing certificate and can hide from the Android launcher after installation; at least 58% of affected devices had call forwarding active. The MR ROBOT kit, which shares components such as call forwarding and per‑customer builders with FatBoyPanel and RedWing, has not been publicly documented before this report.

CloudSEK urged users to avoid installing bank-branded apps from text or messaging links and recommended banks migrate customers to app-based or FIDO authentication where feasible.