MR ROBOT: A Rented Android Trojan That Hijacks a Bank's Fraud Call

MR ROBOT is a malware-as-a-service platform that lets paying affiliates generate their own bank-impersonating Android trojans. The installed app intercepts one-time passcodes by SMS, captures card and identity details on fake screens, and silently forwards calls so a bank's fraud-check callback is answered by the attacker.

Malware-as-a-service means the author rents a ready-made kit to others, who then run their own campaigns. Here the kit is a Telegram bot called APK Shield, a web control panel labelled version 7.0 and an app builder. Call forwarding is a carrier feature that sends incoming calls to another number; the malware switches it on with the code *21*number# without the owner's knowledge.

Analysis based on CloudSEK research published on 28 October 2026. Threat Watch has also covered a different Android banking malware campaign that starts with a phone call.

How does MR ROBOT build a bank-branded Android trojan on demand?

CloudSEK describes one path from the affiliate's order to the victim's account. Steps 1 to 3 are the build and the lure; steps 4 to 6 are the install, the theft and the call hijack.

1. An affiliate contacts the APK Shield bot on Telegram. The bot runs a demo-then-paid model, and the price is not stated in the report.
2. The affiliate picks a lure from a catalog of about 36 ready-made apps. CloudSEK counts nine bank impersonations, plus utility, telecom, traffic-fine ("RTO Challan"), customer-support and credit-card-application lures.
3. The bot mints a "Shoot URL", a Play-Store-style install page for that build. CloudSEK reports the lures arrive as links minted by the bot, consistent with the WhatsApp and APK sideloading pattern seen in other India-focused campaigns.
4. The victim installs a dropper. It requests permission to install packages and to list installed apps, runs a local VPN service named ApkShieldVpnService, checks the device for emulator signs, and waits for several launches and at least 48 hours before installing the payload. The finished app has no launcher icon.
5. The payload holds the SMS and call permissions. It reads incoming messages, shows HTML overlays that capture Aadhaar, PAN, card, PIN and UPI details, and sends the data on through a Firebase database or Telegram.
6. It enables unconditional forwarding with *21*number#, so a call from the bank to the victim rings the attacker's number instead.

What a defender sees at each stage

The table lists what each step looks like from the outside. It is AegisAI's reading of the reported chain.

The reported figures

CloudSEK studied two affiliates in detail. The counts describe those two, not the whole platform.

How can a defender detect an MR ROBOT infection?

Detect the behaviour on the phone, not the certificate. CloudSEK advises banks to hunt for the listed packages and certificates, and tells customers to review which apps hold SMS and call permissions. Because every build is signed with a new certificate, blocklisting certificate hashes does not scale.

Four signals from the report make workable checks on managed phones:

• An app with no launcher icon that holds SMS and call permissions.
• Packages that match com.apkshield.installer.* or com.godz.myapplication, and a local VPN service named ApkShieldVpnService.
• Unconditional call forwarding that the user never set up. Dialing ##21# cancels it, according to CloudSEK.
• Missed calls from a bank, or an unexpected KYC app, reported by a customer. CloudSEK says banks should treat SMS passcodes as compromised in those cases.

What this means for a security team

This section is AegisAI's analysis. CloudSEK reports victims who are bank customers in India and names no corporate victim. The exposure for other organizations is indirect: staff phones that receive SMS passcodes for work accounts, and managed Android devices that allow installs from unknown sources. A phone that forwards calls and reads text messages undermines any process that treats a code sent by SMS or a call to the phone as proof of identity.

Three questions settle the exposure: which accounts still depend on SMS passcodes, whether managed Android phones can install apps from outside the official store, and whether the help desk can walk a user through checking call-forwarding settings.

Why standard controls miss it

This section is AegisAI's analysis. The attack avoids each point where a control normally looks. It is not distributed through a store, so store review never sees it. It carries a fresh certificate per build, so reputation lists have nothing to match. It sleeps before acting, so short sandbox runs see a quiet app. Then it uses two channels the bank trusts, an SMS and a phone call, so the bank's own checks pass. The one earlier point that remains is the message that carries the install link.

How AegisAI protects against it

AegisAI has not observed this campaign. CloudSEK reports that the install links come from a Telegram bot and are consistent with WhatsApp sideloading; it reports no email delivery. A mobile app on an infected phone is outside what an email security product can see, so the approach below applies only where the same kind of lure link reaches a work mailbox.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

See a fake bank-app lure investigated How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Move staff and customer authentication from SMS passcodes to app-based authenticators or FIDO security keys where feasible, as CloudSEK advises banks.
• Block installs from unknown sources on managed Android phones, keep Google Play Protect on, and review which apps hold SMS and call permissions.
• Where a customer or employee reports missed calls from a bank or an unexpected KYC app, treat SMS passcodes on that phone as compromised, have the user dial ##21# to cancel call forwarding, and reset credentials from a clean device.
• Brief staff and customers that a bank, tax or "update" app is never installed from a link in a chat message or a text.
• For banks and telecom providers: report the Telegram bot, the Cloudflare Pages panels and the Firebase project to their providers, because CloudSEK notes that disabling one affiliate's Firebase project would disrupt that affiliate's whole catalog.

FAQ