CyberDakait Android malware targets 17,960 Indian devices

Group-IB has uncovered a sizeable CyberDakait Android malware operation that has compromised at least 17,960 Android devices across India since mid-2025. The campaign combines seven Android trojan families—cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat/GhostGrab, and tenxen—with the d-miner XMRig cryptocurrency miner dropped by a GitHub-hosted dropper.

Victims span 11 Indian banks and two government programmes, with attackers intercepting 7,611,443 SMS messages and resulting in reported losses exceeding $30,500. The operation begins with social engineering via vishing calls and WhatsApp/SMS smishing messages about a “Credit Card Protection Plan”, directing victims to phishing pages or GitHub-hosted APKs. GitHub repositories linked to the campaign were identified and subsequently deactivated.

Infection unfolds through a four-stage phishing flow and a multi-stage payload. A dropper, tracked as d-miner, presents a fake Google Play Store update screen and prompts users to disable battery optimisations, enabling background activity. d-miner decrypts an AES-CBC payload to run XMRig, using wake locks, foreground notifications, and a silent audio loop.

The four-stage flow collects credit card details, internet banking credentials and card security codes, personal identifiers (mobile number, date of birth, PAN), and a photo of the card front. Command-and-Control channels vary by trojan family, with data exfiltrated to Telegram bots, Firebase databases or remote HTTP servers.

While CyberDakait attribution is supported by shared lures and delivery hosts, Group-IB notes that no formal threat group name has been assigned and that individual trojans may be built by separate sub-projects.