Breaches and incidents
Salvador Stealer (India): fake bank e-KYC APK steals Aadhaar, PAN and net banking credentials
ANY.RUN analysed a dropper (IOC name “INDUSLND_BANK_E_KYC.apk”) that installs a second-stage base.apk posing as a banking app, collecting registered mobile...
- Disclosed
- Verification
- Checked against a primary source
What happened
- ANY.RUN analysed a dropper (IOC name “INDUSLND_BANK_E_KYC.apk”) that installs a second-stage base.apk posing as a banking app, collecting registered mobile number, Aadhaar, PAN, DOB and net banking user ID and password, and intercepting incoming SMS including OTPs.
- Technique: phishing WebView from t15.muletipushpa[.]cloud (t01 to t15 subdomains); exfiltration to the phishing server and a Telegram bot; SMS forwarding to an attacker number with HTTP fallback; WorkManager and BOOT_COMPLETED persistence; admin panel left public.
- Attacker: unnamed; an Indian WhatsApp contact number in the kit.
- Response: IOCs published.