RTO Challan Scam: How a Fake Traffic Ticket and a Malicious VPN Can Drain Your Bank Account

A new mobile fraud operation targeting millions of Indian smartphone users has been uncovered, with a campaign distributing a malicious “RTO Challan” app via WhatsApp designed to hijack devices and steal banking credentials and biometric data, according to CYFIRMA’s research team. The attack begins with traffic-challenging messages claiming to be from official transport authorities, urging victims to download an “E-Challan” or “RTO Challan” app to view photographic evidence of a violation.

Once installed, the two-stage dropper uses obfuscation and high-risk Android permissions to establish persistent control and to run a second invisible payload that hides from the app drawer. The malware builds its own encrypted VPN tunnel to mask exfiltration and C2 communications, routing traffic to jsonserv[.]xyz, enabling real-time theft of Aadhaar, PAN and other personal details alongside banking credentials.

It also intercepts SMS and calls to read OTPs, bypassing 2FA, and can trigger USSD codes to forward fraud alerts, while the app presents a fraudulent payment interface that pressures users to enter card details and ATM PINs. Users are advised to block messages from unknown numbers and to avoid downloading challan apps from third-party links. According to CYFIRMA’s research team, immediate detection and coordinated takedown efforts are essential to mitigate its impact.