Beware of MR ROBOT malware: Fake Aadhaar and KYC apps target Indian bank users
By signing in or creating an account, you agree with Associated Broadcasting Company’s and .
Cybersecurity firm CloudSEK uncovered the operation and published its findings on October 28, 2026. According to the investigation, MR ROBOT operates as a Malware-as-a-Service (MaaS) business, where criminals rent ready-made malware to carry out banking fraud. The platform lets paying customers select a bank, generate a fake Android application and distribute it through WhatsApp, SMS or Telegram.
The attack often begins with a message asking customers to update their Aadhaar or complete bank KYC verification.
Clicking the link takes users to a fake Google Play Store page, where they are encouraged to install an application.
Once installed, the malicious app can hide its icon and begin collecting sensitive information.
CloudSEK researchers that MR ROBOT can:
Intercept SMS messages containing banking OTPs.
Collect Aadhaar, PAN, card details, CVV and banking PINs through fake screens.
Redirect incoming phone calls to numbers controlled by fraudsters.
Send stolen information to an online dashboard accessible to criminals.
The call-forwarding feature is particularly concerning. It could prevent customers from receiving calls from banks attempting to verify suspicious transactions.
CloudSEK discovered that MR ROBOT uses a Telegram bot called APK Shield to distribute malicious applications.
The platform offers approximately 36 fake apps, including those impersonating nine banks, utility services and traffic-fine payment portals.
Some fake RTO challan pages demand payments of ₹9 to ₹10 to collect personal information.
Researchers found evidence of subscription licences and separate dashboards for customers renting the malware.
CloudSEK examined data linked to two customers of the malware platform.
CloudSEK recommends avoiding banking applications distributed through messaging links and checking unexpected call-forwarding settings.
Customers can use the ##21# carrier code to cancel unconditional call forwarding where supported. They should verify the forwarding status with their telecom operator.
Anyone who suspects an infection should contact their bank immediately, secure their accounts and report financial cybercrime through India’s 1930 helpline or the .
MR ROBOT shows how banking malware is becoming easier for criminals to rent and distribute, increasing the risk to Android users who install apps from unverified sources.
Click for more latest . Also get top headlines and from and around the at News9.
The News9live Tech Desk is a specialized team of veteran technology journalists and industry analysts dedicated to decoded the complexities of the digital age. Our mission is to provide the audience with accurate, timely, and deeply researched reporting on the innovations shaping our future. From the rapid evolution of Generative AI and critical cybersecurity updates to the hardware that powers our daily lives, we prioritize clarity and consumer advocacy in every story.
At News9live, we uphold the highest standards of journalistic integrity. Every report is fact-checked and vetted to ensure that our readers receive the most authentic and impactful news from the ever-changing world of technology.