Breaches and incidents
FatBoyPanel (India): banking trojan campaign leaks stolen data of ~50,000 Indian users through open Firebase buckets
Zimperium zLabs found about 900 to 1,000 malicious APKs spread over WhatsApp as government or banking apps, mainly targeting Indian bank customers.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Zimperium zLabs found about 900 to 1,000 malicious APKs spread over WhatsApp as government or banking apps, mainly targeting Indian bank customers; over 222 publicly accessible Firebase storage buckets held about 2.5 GB of victims’ bank SMS, card and bank details and government ID data, an estimated 50,000 users.
- Technique: SMS forwarding to about 1,000 live attacker phone numbers (about 63% registered in West Bengal, Bihar and Jharkhand), Firebase exfiltration with no authentication, overlay login screens, hidden icons, uninstall resistance.
- Attacker: FatBoyPanel operation (unnamed operators).
- Response: Zimperium published findings; no arrests reported.