NexusRoute Uncovered: Android RAT Impersonates Indian E-Challan via GitHub for UPI Fraud & Surveillance

NexusRoute is described as a highly coordinated Android malware operation that impersonates Indian Government Ministry services, specifically the mParivahan and e-Challan platforms, to enable UPI fraud and surveillance. according to CYFIRMA, the campaign relies on GitHub repositories and GitHub Pages to host malicious APKs and phishing pages that mimic official download portals, with threat actors registering mass domains such as rtochallan[digits].store to create a redundant network designed to survive takedowns.

Victims are drawn in by schemes around verifying vehicle ownership or paying traffic challans, with phishing flows designed to steal mobile numbers, vehicle data, UPI PINS, OTPs and card details through fake payment verifications. The campaign also deploys a native-backed, multi-stage Android RAT capable of SMS interception, SIM profiling, contact theft, call-log harvesting, file access, screenshot capture, microphone activation and GPS tracking, using JNI-based payloads to hide core logic.

An embedded email address within the malware, gymkhana[.]studio@gmail[.]com, links the toolchain to a broader Android obfuscation and spyware tooling ecosystem known as Gymkhana Studio, suggesting a professionally maintained infrastructure rather than a low-skill scam. Security teams and telecom providers are urged to disrupt the C2 infrastructure and take down hosting repositories.