In recent months, a sophisticated Android malware campaign has emerged, targeting banking users in India under the disguise of a “KYC verification” application. Distributed primarily through WhatsApp, this malware leverages social engineering and advanced evasion techniques to compromise devices and harvest highly sensitive financial data.

This article breaks down the architecture, behavior, and risks associated with this campaign, offering a clear, technical understanding suitable for cybersecurity professionals, researchers, and informed users.

Introduction to the Threat

The malware masquerades as a legitimate banking compliance application, tricking users into believing they must complete a mandatory KYC update. Once installed, it initiates a multi-stage infection chain designed to maintain persistence, evade detection, and exfiltrate financial data.

At its core, the attack combines:

Social engineering (fake update prompts)
Multi-stage payload delivery
Native code obfuscation
Real-time command-and-control (C2) communication
WebView-based phishing interfaces

This layered approach significantly increases its effectiveness and resilience.

Multi-Stage Dropper Architecture

The malware operates using a two-stage design:

Stage 1: Dropper Application

Disguised as a banking app
Requests permission to install unknown apps
Decrypts an embedded payload using XOR-based logic
Installs a hidden secondary APK silently

Stage 2: Payload Execution

Runs without appearing in the app launcher
Gains access to SMS, calls, and system-level functions
Establishes persistent communication with a remote server

This architecture allows the initial app to appear relatively benign while the real malicious activity is handled by the hidden payload.

Advanced Obfuscation Using Native Code

One of the most notable aspects of this malware is its use of native libraries (.so files) to conceal critical components such as:

C2 endpoint: https://jsonapi[.]biz
Encryption keys
Agent identifiers

By moving these elements into native code, attackers significantly reduce visibility during static analysis, making reverse engineering more complex.

Command-and-Control via Firebase

Instead of relying solely on traditional HTTP communication, the malware integrates Firebase Cloud Messaging (FCM) for remote command execution.

Capabilities include:

Sending SMS messages
Intercepting incoming SMS (including OTPs)
Initiating phone calls
Executing USSD commands

This hybrid communication model (Firebase + HTTP backend) improves reliability and reduces detection risk.

Telephony and SMS Exploitation

The malware heavily abuses Android telephony features:

SMS interception: Captures OTPs and forwards them to attackers
Bulk SMS extraction: Dumps entire inbox data
Call control: Initiates calls remotely
USSD execution: Enables call forwarding and network queries

This functionality directly supports financial fraud operations.

VPN-Based Traffic Manipulation

A particularly dangerous feature is the built-in VPN service:

Routes all device traffic through a controlled tunnel (10.0.0.2)
Enables real-time traffic monitoring and filtering
Can disrupt security services like Google Play Protect

This effectively turns the infected device into a monitored endpoint under attacker control.

WebView Phishing Framework

The malware includes a Next.js-based phishing interface rendered inside a WebView.

Phishing Flow:

Mobile number + ATM PIN
Aadhaar + date of birth
Card details (number, CVV, expiry, PIN)
Fake “verification in progress” screen

This staged approach increases user trust and completion rates, maximizing data theft.

Data Exfiltration Pipeline

All collected data is:

Structured into JSON format
Encrypted locally
Sent via HTTP POST requests to the C2 server

Each transmission includes:

Device ID
Timestamp
Event metadata

This indicates a well-organized backend capable of managing large-scale fraud operations.

Persistence Mechanisms

To remain active and undetected, the malware:

Requests battery optimization exemption
Uses WAKE_LOCK for continuous execution
Hides its launcher icon
Operates independently of the original dropper

These techniques ensure long-term persistence on infected devices.

Threat Actor Insights

Evidence suggests a connection to previous e-Challan fraud campaigns, based on:

Similar domain patterns (jsonserv, jsonapi)
Shared phishing themes
Identical attack techniques

The infrastructure evolution—from basic obfuscation to native code concealment—indicates increasing sophistication and adaptation.

Security Implications

This campaign highlights several critical risks:

Large-scale credential harvesting
Real-time OTP interception
Full device surveillance via VPN
Stealthy persistence mechanisms

It represents a mature, financially motivated cybercrime operation targeting mobile users.

Our Opinion on This Case

This malware campaign is not just another phishing attempt—it represents a significant evolution in mobile financial threats. What stands out is the level of operational maturity. The attackers are no longer relying on simple fake apps; instead, they are deploying multi-stage architectures, native code obfuscation, and hybrid communication systems that rival advanced persistent threats.

The use of Firebase for command delivery is particularly clever. It blends malicious traffic with legitimate services, making detection far more difficult. Combined with VPN-based traffic control, this creates a highly controlled environment where the attacker can monitor, manipulate, and exploit user activity with minimal interference.

However, the most concerning aspect is the psychological precision of the attack. The staged KYC workflow mirrors real banking processes closely enough to deceive even cautious users. This indicates a deep understanding of user behavior, not just technical capability.

From a defensive standpoint, traditional antivirus solutions alone are no longer sufficient. Behavioral detection, user awareness, and strict app installation policies are now essential.

Ultimately, this campaign reinforces a critical reality: mobile devices have become primary financial targets, and attackers are investing heavily in making their tools more stealthy, scalable, and convincing than ever before.

INDICATORS OF COMPROMISE

Indicator	Type	Remarks
34479b18597f1a0deb5d55b8450bc21af1d1f638c4ceca1ee19e6f5ac89d6be2	Sha256	Dropper
1d261b45e73b5b712becb12ed182ec89d3dd0d73143a2dd8ff5512da489a50eb	Sha256	Dropped apk
Jsonapi[.]biz	Domain	C2
jsonserv[.]biz	Domain	C2
jsonserv[.]xyz	Domain	C2

MITRE ATTACK FRAMEWORK For Mobile

S.N	Tactic	Technique
1.	Initial Access (TA0027)	T1660: Phishing
2.	Persistence (TA0028)	T1541: Foreground Persistence T1603: Scheduled Task/Job
3.	Defense Evasion (TA0030)	T1628: Hide Artifacts T1628.002: Hide Artifacts: User Evasion T1406: Obfuscated Files or Information
4.	Credential Access (TA0031)	T1417: Input capture
5.	Discovery (TA0032)	T1418: Software Discovery T1426: System Information Discovery T1422: Internet Connection Discovery
6.	Collection (TA0035)	T1414: Input capture T1636.004: Protected User Data: SMS Messages T1636.002: Protected User Data: Call log T1616: Call Control
7.	Command and Control (TA0037)	T1437: Application Layer Protocol T1437.001: Application Layer Protocol: Web Protocols T1521: Encrypted Channel T1481: Web Services
8.	Exfiltration (TA0036)	T1646: Exfiltration Over C2 Channel

Massive Android Banking Scam Uncovered: Fake KYC App Spreads via WhatsApp, Steals OTPs and Financial Data Through Hidden Malware Pipeline