MR ROBOT Malware Service Lets Criminals Rent Custom Banking Trojans Aimed at Indian Customers

A new Android malware-as-a-service operation called MR ROBOT has been found renting customised banking trojans to criminals who target Indian bank customers. Research published on October 28 by threat intelligence firm CloudSEK describes an operator control panel, a Telegram-based storefront and a builder that lets affiliates create bank-themed Android apps on demand. Each affiliate gets its own application ID, and the platform supports resellers with sub-admin accounts and time-limited licences.

The lures spread through fake Play Store-style pages and messaging-app links, impersonating banks, utility providers and government services. Once installed, the malware intercepts text messages containing one-time passwords, shows fake screens to harvest banking credentials, card details, PINs and identity information, and can silently enable call forwarding. CloudSEK said this can redirect incoming calls, including banks' fraud-check callbacks, to a number the attackers control. Each build gets a fresh signing certificate and can hide from the Android launcher after installation.

CloudSEK tracked two affiliates. One panel held around 154 devices and about 3270 intercepted messages, while an exposed Firebase database linked to a second held 153 devices and 5407 messages, collected between July 16 and 30, 2026. Call forwarding was active on 58% of devices. CloudSEK said MR ROBOT shares features with FatBoyPanel and RedWing, but its kit, storefront and panel had not been publicly reported before.