Breaches and incidents
RTO e-Challan APK fraud (India): fake traffic-fine WhatsApp messages install banking/identity stealer
CYFIRMA analysed “RTO Challan_v10.0.apk”, first seen October 2025 and sent over WhatsApp as official traffic-violation alerts with fake challan and vehicle...
- Disclosed
- Verification
- Checked against a primary source
What happened
- CYFIRMA analysed “RTO Challan_v10.0.apk”, first seen October 2025 and sent over WhatsApp as official traffic-violation alerts with fake challan and vehicle numbers. The app shows a fake e-Challan page collecting name, mother’s name, DOB, Aadhaar, PAN, card number, CVV, ATM PIN, net banking credentials and UPI PIN, and intercepts SMS OTPs.
- Technique: dropper installs a hidden second-stage APK; SMS, call and USSD permissions; REQUEST_INSTALL_PACKAGES; a custom VPN service; C2 jsonserv[.]xyz and jsonserv[.]biz. Victims continue: two Pune residents lost Rs 14.16 lakh to fake RTO e-challan APKs (reported 27 Jun 2026, Bridge Chronicle).
- Attacker: not attributed.
- Response: IOCs and YARA rule published.