New Delhi: A previously unreported cyber criminal gang operating under the name Mr Robot is renting out technical tools to fraudsters to compromise the mobile phones of Indian banking customers, cyber security firm CloudSEK said on Wednesday.
According to CloudSEK, which found the gang while investigating an app impersonating a public-sector bank, Mr Robot runs its own admin app and leases "crimeware" platforms to other fraudsters. Once the malicious app is installed, its icon disappears from the phone. "From that moment, every OTP the customer receives goes to a fraudster's dashboard. Calls from the bank are silently forwarded to another number," the company said.
The malware is built to survive detection. It stays dormant for at least 48 hours to get past automated security checks, and every copy carries a new digital signature, so security tools cannot block a new version by matching it to an old one. It reads incoming SMS to lift OTPs, and uses the carrier code *21# to forward the victim's calls to the fraudsters, so verification calls from the bank never reach the customer.
The lure catalogue holds about 36 fake apps: nine public- and private-sector banks, gas, water and electricity bill payment pages, and "RTO Challan" traffic-fine screens that charge a Rs 9 to Rs 10 "fee" to collect PAN and other personal details. Once inside, fake screens collect Aadhaar, PAN, card number, CVV, ATM PIN, UPI PIN and net-banking credentials.
The scale is set out in the data from just two affiliates. One had about 154 infected phones and about 3,270 intercepted messages. The other left its database exposed: as of July 30, 2026, it held 153 infected phones and 5,407 intercepted SMS messages, with OTPs from more than a dozen banks and payments banks. Call forwarding was active on 58 per cent of those victims, and 149 of the phones were infected in a single burst in May. Most victims used budget Android phones, with SIMs from all four major Indian carriers.
The findings sketch the intake end of the chain the Supreme Court described earlier on Wednesday, when it called cyber crime "digital dacoity" and refused to club the multiple mule-account cases against two people. The account that receives a defrauded senior citizen's money is at the far end of a pipeline that begins with an app like this one, installed by a person who was told it was a bill payment tool or a bank update.
No bank sends an app as an APK over WhatsApp, Telegram or SMS. Install only from the Play Store, and check the developer name, not just the logo.
An icon that vanishes after installation is not a glitch. Neither is a banking app that asks for SMS and call permissions.
If OTPs stop arriving, or calls from your bank never ring through, check forwarding: dial *#21# and see whether anything is active.
A Rs 9-10 "challan" payment page that wants your PAN and Aadhaar is harvesting data, not collecting a fine. Traffic challans are paid on official police or transport portals.
If money has moved, report on cybercrime.gov.in immediately and ask your bank to freeze the beneficiary account - the first hour decides whether the trail survives.
(With inputs from PTI and media reports)