Fraudulent Scholarship Apps: A New Malware Campaign Targets Students in Bangladesh

According to CRIL, Cyble Research and Intelligence Labs, a new Android malware campaign dubbed SikkahBot has been active since July 2024 and is targeting students in Bangladesh by disguising itself as official Bangladesh Education Board scholarship apps. The malicious apps are distributed via shortened links and smishing, redirecting users to rogue APK download sites.

Once installed, victims are prompted to log in with Google or Facebook and then must provide personal details, including name, department and institute, followed by payment information such as wallet number, PIN and payment type. SikkahBot abuses extensive permissions, including Accessibility Service, SMS, call management and overlay, enabling deep device control and SMS interception to exfiltrate data to a Firebase server controlled by the attackers.

It monitors for interactions with banking apps like bKash, Nagad and Dutch-Bangla Bank to automatically enter retrieved PINs, and can also fall back to USSD-based transactions when targeted apps are not in use. Since its discovery, CRIL notes multiple variants with enhanced automation, and the malware remains largely undetected on VirusTotal despite rapid iteration.