MediumII Cyber Warfare & Critical Infrastructure29 October 2026, Thursday
Trojans hijack nearly 18,000 phones belonging to Indian bank customers
Group-IB said on 28 October that a cluster it calls CyberDakait has compromised at least 17,960 devices with 7 Android trojan families and read 7,611,443 text messages. The campaign impersonates 11 Indian banks and 2 government schemes.
According to Group-IB, the cluster has targeted India's financial sector since July 2025. The attacker poses as a bank representative and urges the victim to cancel a 'credit card protection plan' supposedly activated without their consent. The victim is steered to a fake bank site and enters card number, CVV, internet banking password and identity details. Some of the malicious app files were hosted on GitHub; the 16 accounts Group-IB reported have been taken down.
A GBHackers summary dated 29 October says 2,364 of the compromised devices were identified from installation notifications and 15,596 from exposed Firebase databases. The trojans intercept one-time passwords (OTPs, the codes banks send by text message to approve transactions), forward calls and control the phone remotely. An additional component mines the Monero cryptocurrency while the device is locked. Command traffic runs through Telegram bots and Firebase.
Total victim losses reported by Group-IB are only a little over 30,500 dollars; the fees the fraudsters claimed ranged from 5 to 150 dollars. The report does not name the impersonated banks and does not mention the Reserve Bank of India or any response from the banks. Group-IB describes CyberDakait as an analytical cluster rather than a single operator; the identity of those responsible could not be verified.
Talay assessment
Bottom line
The problem is not the size of the losses but the depth of access. 7.6 million text messages show that banking security in India still rests on one-time passwords sent by SMS, and that this channel can be read at scale. The reported loss of 30,500 dollars may be a small slice of the real damage. The most likely path is regulatory pressure that speeds the move away from SMS-based authentication.
Likely effects
- Indian banking securityNegative1–6 months
Proof across 17,960 devices that SMS passwords can be intercepted pushes banks towards in-app and device-bound authentication.
- Cyber insurabilityNegative1–6 months
Fraud that starts on the customer's device may bring social engineering exclusions in banks' cover into question; the financial impact could not be verified.
- Code hosting platformsUncertainWeeks
GitHub's trusted domain was used to distribute malicious files; the takedown of 16 accounts also shows how easily the channel can be replenished.
Possibilities, ranked
- 1The campaign returns under new names60%
New GitHub accounts replace those taken down, and the same families keep circulating with fresh bank impersonations.
Watch: New indicators on the same families from Group-IB or another firm
- 2Regulators tighten rules30%
India's computer emergency response team CERT-In or the RBI issues new guidance on authentication beyond SMS.
Watch: A new CERT-In advisory on Android banking trojans
- 3Perpetrators identified10%
Police trace the operators through the Telegram and Firebase trail and announce arrests.
Watch: An Indian police announcement of arrests linked to CyberDakait
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Compromised devices▼ 17,960+
- Messages read▼ 7.6mn