Incident Overview: “Twice is Wise” Cyber Awareness Campaign – Social Engineering RAT Malware via Fake KYC Updates
Executive Summary
On 31 January, India’s national cyber-awareness initiative Twice is Wise concluded its final phase after highlighting a widespread and ongoing cyber threat targeting Android users. The campaign focused on malicious attacks where threat actors impersonated banks and financial institutions to distribute malware disguised as mandatory KYC update applications.
These attacks relied heavily on social engineering rather than software vulnerabilities, exploiting user trust, urgency, and lack of awareness. Once installed, the malicious applications deployed Remote Access Trojans (RATs) that allowed attackers to take control of infected devices, steal sensitive data, intercept banking credentials, and perform unauthorized financial transactions.
The campaign did not respond to a single breach but addressed a pattern of repeated real-world incidents affecting thousands of users across India, especially mobile banking customers.
What Happened
Threat actors launched coordinated phishing campaigns targeting Android users with messages claiming that their bank account, wallet, or UPI service would be suspended unless KYC was updated immediately.
Victims received:
- SMS messages
- WhatsApp messages
- Telegram messages
- Occasionally emails
These messages contained:
- A fake warning (account blocked, KYC expired, transaction failed)
- A shortened or masked URL
- Instructions to download and install an “official” KYC update app
Once the user installed the app and granted requested permissions, the malware silently installed a Remote Access Trojan, giving attackers persistent access to the device.
How the Attack Worked
1. Initial Infection Vector
Initial Vector:
Social engineering via SMS and messaging apps.
No operating system vulnerability was exploited. The attack relied entirely on user interaction.
Typical message content:
- “Your bank KYC has expired”
- “UPI services will be blocked today”
- “Re-verify account to avoid suspension”
The messages often:
- Spoofed sender IDs to resemble banks
- Used official-looking logos and language
- Included shortened links to hide the real destination
2. Payload Delivery
The malicious link redirected users to:
- Fake banking web pages, or
- Direct APK download links hosted on:
- Compromised websites
- Free file-hosting services
- Cloud storage links
The downloaded file appeared as:
- “KYC_Update.apk”
- “Bank_Verification.apk”
- “Secure_UPI.apk”
These apps were not distributed through the Google Play Store.
3. Permissions Abuse
Once installed, the app requested excessive permissions, including:
- Accessibility Services
- SMS read/write
- Call logs
- Contacts
- Screen overlay
- File system access
- Device admin privileges
Victims were guided through enabling these permissions with fake instructions claiming they were required for verification.
4. RAT Activation and Command Execution
After permissions were granted, the malware:
- Connected to a remote Command-and-Control (C2) server
- Registered the infected device using a unique ID
- Downloaded additional modules if required
Attackers could then:
- View the victim’s screen in real time
- Capture keystrokes and PIN entries
- Read OTP messages automatically
- Intercept UPI and banking notifications
- Initiate transactions remotely
- Install additional malware silently
Malware Capabilities
The deployed RATs typically supported:
- Screen recording and live viewing
- SMS interception (including OTPs)
- Call forwarding and call recording
- Keylogging via accessibility abuse
- Banking app overlay attacks
- File exfiltration (documents, photos)
- Persistence after reboot
- Disabling security notifications
These capabilities allowed attackers to bypass two-factor authentication and conduct fraud in real time.
Was Any Vulnerability Exploited?
No software vulnerability was exploited.
This attack:
- Did not rely on Android OS flaws
- Did not bypass sandboxing
- Did not exploit zero-days
It succeeded purely because:
- Users installed apps from unknown sources
- Excessive permissions were manually granted
- Fake urgency lowered suspicion
This makes it especially dangerous, as traditional patching does not stop it.
Impact Assessment
Affected Systems
- Android smartphones (primarily Android 9–13)
- Devices used for:
- Mobile banking
- UPI transactions
- Digital wallets
- Personal email and documents
Affected Data
- Banking credentials
- UPI PINs
- OTPs
- Personal contacts
- Identity documents
- Stored photos and files
Impact on Victims
- Unauthorized bank transfers
- Wallet draining
- Account takeovers
- Identity misuse
- Loss of personal and financial data
Many victims were unaware of compromise until funds were already transferred.
Indicators of Compromise (IOCs)
Device-Level Indicators
- Unknown apps installed outside Play Store
- Apps requesting Accessibility Services without clear reason
- Phone becoming slow or overheating
- Unexpected pop-ups over banking apps
- Increased data usage
Behavioral Indicators
- SMS messages marked as “read” automatically
- Banking actions happening without user input
- Device waking up or screen activating on its own
Network Indicators
- Persistent outbound connections to unknown IPs
- Encrypted traffic to non-standard domains
- Traffic spikes after app installation
(Exact IPs/domains varied frequently to evade blocking.)
Detection Guidance
On Mobile Devices
- Review Accessibility permissions regularly
- Disable “Install unknown apps”
- Monitor device admin privileges
- Check for apps with generic names or no icons
Enterprise / SOC Level
- Flag APK sideloading events
- Detect abnormal Android device traffic patterns
- Monitor SMS access abuse
- Correlate accessibility permission grants with financial app usage
Threat Hunting Guidance
Hypothesis
Android devices compromised via sideloaded APKs abusing accessibility permissions to perform financial fraud.
Hunting Queries
- Devices with accessibility permissions granted to non-system apps
- Devices accessing banking apps immediately after sideload events
- SMS read events without user interaction
- Repeated connections to low-reputation domains
User Behavior Signals
- Financial app usage outside normal hours
- Rapid transaction sequences
- Concurrent screen activity and network exfiltration
Detection Rule
IF
Android device installs APK from unknown source
AND
App requests Accessibility Service
AND
Device accesses banking or UPI app within short time window
THEN
Flag as suspected mobile RAT infection
Why This Campaign Matters
The Twice is Wise campaign emphasized that modern cybercrime is no longer about breaking systems — it’s about manipulating people. These attacks succeed not because devices are weak, but because attackers understand human behavior.
By focusing on:
- Awareness
- Real attack patterns
- Practical examples
the campaign aimed to reduce the success rate of these scams rather than respond after financial loss occurs.
Final Takeaway
This was not a single breach — it was a repeating national threat pattern. The attackers used simple tools, believable messages, and psychological pressure to achieve high success rates. Preventing such attacks depends less on technology and more on user awareness, permission hygiene, and behavioral monitoring.
