Incident Overview: “Twice is Wise” Cyber Awareness Campaign – Social Engineering RAT Malware via Fake KYC Updates

Executive Summary

On 31 January, India’s national cyber-awareness initiative Twice is Wise concluded its final phase after highlighting a widespread and ongoing cyber threat targeting Android users. The campaign focused on malicious attacks where threat actors impersonated banks and financial institutions to distribute malware disguised as mandatory KYC update applications.

These attacks relied heavily on social engineering rather than software vulnerabilities, exploiting user trust, urgency, and lack of awareness. Once installed, the malicious applications deployed Remote Access Trojans (RATs) that allowed attackers to take control of infected devices, steal sensitive data, intercept banking credentials, and perform unauthorized financial transactions.

The campaign did not respond to a single breach but addressed a pattern of repeated real-world incidents affecting thousands of users across India, especially mobile banking customers.

---

What Happened

Threat actors launched coordinated phishing campaigns targeting Android users with messages claiming that their bank account, wallet, or UPI service would be suspended unless KYC was updated immediately.

Victims received:

• SMS messages
• WhatsApp messages
• Telegram messages
• Occasionally emails

These messages contained:

• A fake warning (account blocked, KYC expired, transaction failed)
• A shortened or masked URL
• Instructions to download and install an “official” KYC update app

Once the user installed the app and granted requested permissions, the malware silently installed a Remote Access Trojan, giving attackers persistent access to the device.

---

How the Attack Worked

1. Initial Infection Vector

Initial Vector:
Social engineering via SMS and messaging apps.

No operating system vulnerability was exploited. The attack relied entirely on user interaction.

Typical message content:

• “Your bank KYC has expired”
• “UPI services will be blocked today”
• “Re-verify account to avoid suspension”

The messages often:

• Spoofed sender IDs to resemble banks
• Used official-looking logos and language
• Included shortened links to hide the real destination

---

2. Payload Delivery

The malicious link redirected users to:

• Fake banking web pages, or
• Direct APK download links hosted on:
  • Compromised websites
  • Free file-hosting services
  • Cloud storage links

The downloaded file appeared as:

• “KYC_Update.apk”
• “Bank_Verification.apk”
• “Secure_UPI.apk”

These apps were not distributed through the Google Play Store.

---

3. Permissions Abuse

Once installed, the app requested excessive permissions, including:

• Accessibility Services
• SMS read/write
• Call logs
• Contacts
• Screen overlay
• File system access
• Device admin privileges

Victims were guided through enabling these permissions with fake instructions claiming they were required for verification.

---

4. RAT Activation and Command Execution

After permissions were granted, the malware:

• Connected to a remote Command-and-Control (C2) server
• Registered the infected device using a unique ID
• Downloaded additional modules if required

Attackers could then:

• View the victim’s screen in real time
• Capture keystrokes and PIN entries
• Read OTP messages automatically
• Intercept UPI and banking notifications
• Initiate transactions remotely
• Install additional malware silently

---

Malware Capabilities

The deployed RATs typically supported:

• Screen recording and live viewing
• SMS interception (including OTPs)
• Call forwarding and call recording
• Keylogging via accessibility abuse
• Banking app overlay attacks
• File exfiltration (documents, photos)
• Persistence after reboot
• Disabling security notifications

These capabilities allowed attackers to bypass two-factor authentication and conduct fraud in real time.

---

Was Any Vulnerability Exploited?

No software vulnerability was exploited.

This attack:

• Did not rely on Android OS flaws
• Did not bypass sandboxing
• Did not exploit zero-days

It succeeded purely because:

• Users installed apps from unknown sources
• Excessive permissions were manually granted
• Fake urgency lowered suspicion

This makes it especially dangerous, as traditional patching does not stop it.

---

Impact Assessment

Affected Systems

• Android smartphones (primarily Android 9–13)
• Devices used for:
  • Mobile banking
  • UPI transactions
  • Digital wallets
  • Personal email and documents

Affected Data

• Banking credentials
• UPI PINs
• OTPs
• Personal contacts
• Identity documents
• Stored photos and files

Impact on Victims

• Unauthorized bank transfers
• Wallet draining
• Account takeovers
• Identity misuse
• Loss of personal and financial data

Many victims were unaware of compromise until funds were already transferred.

---

Indicators of Compromise (IOCs)

Device-Level Indicators

• Unknown apps installed outside Play Store
• Apps requesting Accessibility Services without clear reason
• Phone becoming slow or overheating
• Unexpected pop-ups over banking apps
• Increased data usage

Behavioral Indicators

• SMS messages marked as “read” automatically
• Banking actions happening without user input
• Device waking up or screen activating on its own

Network Indicators

• Persistent outbound connections to unknown IPs
• Encrypted traffic to non-standard domains
• Traffic spikes after app installation

(Exact IPs/domains varied frequently to evade blocking.)

---

Detection Guidance

On Mobile Devices

• Review Accessibility permissions regularly
• Disable “Install unknown apps”
• Monitor device admin privileges
• Check for apps with generic names or no icons

Enterprise / SOC Level

• Flag APK sideloading events
• Detect abnormal Android device traffic patterns
• Monitor SMS access abuse
• Correlate accessibility permission grants with financial app usage

---

Threat Hunting Guidance

Hypothesis

Android devices compromised via sideloaded APKs abusing accessibility permissions to perform financial fraud.

Hunting Queries

• Devices with accessibility permissions granted to non-system apps
• Devices accessing banking apps immediately after sideload events
• SMS read events without user interaction
• Repeated connections to low-reputation domains

User Behavior Signals

• Financial app usage outside normal hours
• Rapid transaction sequences
• Concurrent screen activity and network exfiltration

---

Detection Rule

IF
  Android device installs APK from unknown source
AND
  App requests Accessibility Service
AND
  Device accesses banking or UPI app within short time window
THEN
  Flag as suspected mobile RAT infection

---

Why This Campaign Matters

The Twice is Wise campaign emphasized that modern cybercrime is no longer about breaking systems — it’s about manipulating people. These attacks succeed not because devices are weak, but because attackers understand human behavior.

By focusing on:

• Awareness
• Real attack patterns
• Practical examples

the campaign aimed to reduce the success rate of these scams rather than respond after financial loss occurs.

---

Final Takeaway

This was not a single breach — it was a repeating national threat pattern. The attackers used simple tools, believable messages, and psychological pressure to achieve high success rates. Preventing such attacks depends less on technology and more on user awareness, permission hygiene, and behavioral monitoring.

---