CyberDakait Credit Card Protection Plan Scam: From Phone Call to Android Malware
The CyberDakait Credit Card Protection Plan scam moves from a fake bank call to a WhatsApp link and Android malware on 17,960 devices in India, Group-IB says.
AegisAI Threat IntelligenceAegisAI Threat Watch · Vishing and Android banking malware
CyberDakait Credit Card Protection Plan Scam: From Phone Call to Android Malware
A call about a plan nobody bought leads to a WhatsApp link, a silent app download and stolen one-time passwords.
- What
- A fake bank call about a Credit Card Protection Plan leads to a WhatsApp link that silently downloads Android banking malware.
- Who it hits
- Indian bank customers with new credit cards. Group-IB counts at least 17,960 infected devices and 11 impersonated banks.
- Why filters miss it
- No email is involved. The lure travels by phone and WhatsApp, and the app is hosted on GitHub.
- Do today
- Block app installs from unknown sources on managed Android phones, and stop relying on SMS codes alone for card changes.
The CyberDakait Credit Card Protection Plan scam is a fake bank call that sends a WhatsApp link, silently installs Android malware and steals card details and one-time passwords.
Threat Watch has covered callback scams that start in email, and the AegisAI blog asks what happens with attacks outside the inbox. This campaign is the second case in full: it never uses email at all. The source is Group-IB's report of 28 October 2026, which names the cluster CyberDakait and says it has targeted India's financial services sector since July 2025.
Source: Group-IB, 28 October 2026. The device count adds 2,364 unique devices seen in 2,805 installation notices to 15,596 devices in an exposed Firebase store.
Key judgments
- The chain runs on a phone, not a mailbox. Group-IB describes a vishing call, a WhatsApp link to a bank-themed page and a silent APK download. Email does not appear in its report.
- The trigger is real. Group-IB found that callers typically reached victims within 24 hours of a new credit card arriving, which makes the "plan already activated" claim plausible.
- The goal is the second factor. Across the cluster the malware intercepts SMS, forwards calls and captures card details through overlays, so a stolen card arrives with the codes needed to use it.
- Seven families, one operation. Group-IB groups GhostBat, cyb3rx, godz, d-passive, d-shine, tenxen and appkjl under CyberDakait on highly similar lures, phishing domains and GitHub hosting, despite different command channels.
- Trusted hosting is part of the method. Group-IB says the APKs sat on GitHub to look legitimate and evade security controls; GitHub has since deactivated the accounts Group-IB reported.
- The losses on record are a floor. Group-IB cites more than $30,500 lost in multiple reported incidents, a figure that covers reported cases only, not the 17,960 devices.
See how AegisAI reads the request inside a lure: watch the explainer, or book a demo.
For the wider picture of AI-driven attacks in Q3 2026, read the State of the AI Attack report. Get the report.
What is the CyberDakait Credit Card Protection Plan scam?
It is a financially motivated fraud scheme that Group-IB tracks under the cluster name CyberDakait. Group-IB says the Credit Card Protection Plan pretext has been active in India since at least January 2025, based on documented victim reports, and that the cluster behind the Android malware has targeted the country's financial sector since July 2025.
The call: a plan nobody bought
A caller posing as the bank says a Credit Card Protection Plan was activated automatically on the new card, with charges of roughly $5 to $150 unless it is cancelled at once. Group-IB's review of victim reports found that the call typically came within 24 hours of the card arriving. The urgency is the cancellation, not a purchase, which turns a suspicious call into a request for help.
The link: a bank page that downloads an app
To cancel, the caller sends a link over WhatsApp, and Group-IB also describes smishing in the same campaigns. The link opens a phishing page styled after the victim's bank, with buttons such as "Login Now", "Apply Now" or "Activate Protection". Any of them triggers an automatic, silent download of an APK hosted in a GitHub repository, with no separate download prompt.
How does the CyberDakait malware steal card details and one-time passwords?
A fake update screen covers the real install
The first APK works as a dropper. Group-IB reports that it shows what looks like the app's own Google Play Store update page while it silently downloads and installs a different application, the real payload, in the background. It then asks the user to disable battery optimization, which Group-IB says is meant to stop Android's background limits from ending the malware's process.
A four-step "cancellation" that collects everything
Group-IB describes the harvest as a cancellation flow in four stages:
- Card number, expiry date and CVV.
- Net banking credentials and the grid numbers printed on the back of the card, framed as a mandatory KYC (customer identity) check.
- Registered mobile number, PAN number and date of birth.
- A photograph of the front of the card.
SMS and call forwarding finish the job
The capabilities Group-IB lists across the cluster are SMS interception and forwarding, call forwarding, and card theft through phishing overlays. Intercepted messages, including one-time passwords and bank transaction alerts, go to the operators in near real time, so the card details and the code that confirms a payment reach the same hands. Group-IB also found a dropper, d-miner, that downloads and runs an XMRig cryptocurrency miner.
What are the seven CyberDakait malware families?
Group-IB separates the activity into seven families that differ in network communication, database structure and message formats, and groups them under one cluster because the lures, phishing domains and GitHub distribution are highly similar. It treats GhostBat as the newer version of a family reported earlier as GhostGrab and tracks the two as one. The channels below are where each family sends intercepted SMS, from Group-IB's own table.
| Family | Where intercepted SMS goes |
|---|---|
| cyb3rx | Telegram bot. A separate admin controller APK, found in a GitHub repository, lets operators switch SMS forwarding on and pull captured card data. |
| godz | Telegram bot |
| appkjl | Remote HTTP server |
| d-shine | Remote HTTP server |
| GhostBat (GhostGrab) | Firebase database |
| d-passive | Firebase database |
| tenxen | Firebase database |
Families can mix channels for other data; GhostBat, for example, checks in through both Telegram and Firebase.
How should banks and financial services firms respond to the CyberDakait scam?
For a bank, the exposure is its customers' phones and its own one-time password flow, not its mail server. Group-IB's advice to individuals is to hang up on unexpected bank calls and phone the official number on the bank's website, never to share card details, CVV or grid numbers unless the customer started the transaction, and to install apps only from official stores. AegisAI's reading is that the institution's part is to make that advice easy to follow and to stop treating an SMS code as proof that the cardholder is present.
Close the gap the script relies on
The script works because a new cardholder cannot easily check whether a plan was added. A clear statement in the card welcome pack, the app and the bank's site that the bank never cancels a product through a link or an app download removes that doubt. This is AegisAI's reading, not a Group-IB recommendation.
Assume SMS can be read by the attacker
With 7,611,443 messages intercepted, SMS codes in this campaign reached the operators as fast as they reached victims. Changes to card limits, new payees and card-not-present payments above a threshold deserve a confirmation that does not travel by SMS, such as an in-app approval bound to the registered device.
A phone call, a WhatsApp link and a GitHub download. No step in this chain passes through a mail filter.
AegisAI Threat IntelligenceWhy standard controls miss it
This section is AegisAI's analysis; Group-IB's report describes the chain, not the gaps. The call reaches a personal phone, and the link arrives in WhatsApp or SMS, outside the email gateways and link scanners that most security teams run. The download comes from GitHub, a domain that few networks block, and Group-IB says that choice was made to look legitimate and evade security controls.
Each step also looks like routine customer service: a call from the bank, a cancellation page, an update screen, a battery prompt. The only step that asks for a security decision is the app install, and the fake Play Store screen is there to make it look like an update of something already trusted.
Where AegisAI fits, and where it does not
As Group-IB reports it, this campaign never uses email. The call and the WhatsApp or SMS link reach a personal phone, which is outside AegisAI and any other email security product. AegisAI applies when the same request arrives by email at a work inbox, such as a notice to cancel a card plan, a KYC update or a link to an app.
Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.
How AegisAI stops credential phishing, 48 seconds
Recommendations for defenders
- On managed Android devices, block app installs from unknown sources through mobile device management, and alert on apps that request SMS access, Accessibility Service access or an exemption from battery optimization.
- For card issuers, move confirmation of limit changes, new payees and high-value card-not-present payments off SMS to an in-app approval bound to the registered device.
- Tell new cardholders, in the welcome pack, the app and on the website, that the bank never cancels a plan through a link or an app download, and publish the one number to call.
- Search DNS and proxy logs for the indicators below and for APK downloads from new GitHub accounts or GitHub Pages sites; treat the list as historical, since GitHub has deactivated the accounts Group-IB reported.
- Add the Credit Card Protection Plan script to awareness training for staff and customers: hang up, call the official number, and never install an app sent during a call.
FAQ
What is the Credit Card Protection Plan scam call?
A caller posing as your bank says a paid Credit Card Protection Plan was activated on your new card and must be cancelled at once to avoid charges. Group-IB reports that the cancellation link sent over WhatsApp leads to a fake bank page that silently downloads Android malware tracked under the cluster name CyberDakait.
Is a call about my credit card protection plan real or fake?
Treat it as fake if it pushes you to cancel through a link or to install an app. Group-IB documents exactly this script as the CyberDakait pretext. Hang up and call the number on your bank's official website, and never share card details, CVV or grid numbers on a call you did not start.
Does email security for banks and credit unions stop the CyberDakait scam?
No. As Group-IB reports it, the scam starts with a phone call and a WhatsApp or SMS link to a personal phone, so no email product sees it, AegisAI included. Email security helps only when the same lure arrives by email. Phone-side controls and SMS-free payment confirmation matter more here.
What are the seven CyberDakait Android malware families?
Group-IB lists GhostBat (the newer version of GhostGrab), cyb3rx, godz, d-passive, d-shine, tenxen and appkjl. They use different command channels, Telegram, Firebase or a remote server, but share highly similar lures, phishing domains and GitHub hosting, and they intercept SMS, forward calls and steal card details.
For researchers
What the reporting does not tell us 4 gaps
Attribution. Group-IB names the cluster CyberDakait and calls it financially motivated. It does not tie it to a person or a known group.
Which banks. Group-IB counts 11 Indian banking institutions and 2 government programs impersonated but does not name them in its report.
Losses. The figure of more than $30,500 covers multiple reported incidents. Group-IB gives no loss estimate for the 17,960 devices and names no currency beyond the dollar sign.
Reach beyond India. The report is scoped to India's financial sector. It does not say whether the script or the seven families have been seen elsewhere; that absence is AegisAI's reading of the report.
Indicators published by Group-IB selection
A selection from Group-IB's indicator list. Domains are written with [.] so they cannot be clicked. GitHub has deactivated the accounts Group-IB reported, and phishing domains churn, so treat these as historical context and hunting leads, not a live blocklist.
| Type | Indicator |
|---|---|
| Phishing domains | cancelcardprotection[.]onlinecardsprotection[.]incardprotections[.]indeactivatecpplan[.]indeactivatecpservice[.]incancelcpservice[.]inmanageprotectionplan[.]inpolicydeactivate[.]inmanagecp[.]comcppmanage[.]in |
| GitHub Pages sites | hamzaansari1612-ux[.]github[.]iorohansingh253641-spec[.]github[.]io |
| GitHub accounts (deactivated) | ranidevisingh901-debug (hosted the cyb3rx admin controller)muhaamad852-netizenDeactiveCpp4ugopalmalo36374-beep |
| Command servers | 64.89.163[.]3 (cyb3rx admin controller API)64.89.163[.]478.159.156[.]74144.31.244[.]18446.151.182[.]28fud2026[.]com and subdomains |
| APK SHA-256 | 0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856 (cyb3rx)9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8 (godz)43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6 (GhostBat)d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f (tenxen) |
MITRE ATT&CK mapping 6 techniques
This mapping is AegisAI's own reading of the reported behaviour. Group-IB's report lists no technique IDs. Five rows come from the Mobile matrix; T1583.006 is from the Enterprise matrix.
| ID | Name | Use in this campaign |
|---|---|---|
T1660 | Phishing (Mobile) | After the call, a WhatsApp or SMS link sends the victim to a bank-themed page that starts the APK download. |
T1417.002 | Input Capture: GUI Input Capture | Phishing screens and overlays collect card, net banking, PAN and date of birth details as a cancellation and KYC flow. |
T1636.004 | Protected User Data: SMS Messages | The trojans read incoming SMS, including one-time passwords and bank alerts. |
T1616 | Call Control | The malware can forward phone calls on the operator's command. |
T1646 | Exfiltration Over C2 Channel | Intercepted SMS and device check-ins go to Telegram bots, Firebase or a remote server, depending on the family. |
T1583.006 | Acquire Infrastructure: Web Services | The operators host the APKs and the cyb3rx admin controller in GitHub repositories. |
References 2 sources
- Group-IB (28 Oct 2026). Report on the CyberDakait cluster and seven Android trojan families targeting Indian banking apps. group-ib.com
- MITRE ATT&CK. Mobile techniques T1660, T1417.002, T1636.004, T1616 and T1646; Enterprise technique T1583.006. attack.mitre.org
Every email, investigated.
When a lure like this one reaches a work inbox, see how AegisAI reads the request inside it and pulls it before anyone clicks.
Phishing that reaches the inbox, stopped before anyone clicks.
Book a demoRelated posts
More from the AegisAI blog.