CyberDakait: Inside the Fake Card Protection Scam Draining Indian Bank Customers
Your new credit card arrives. Within 24 hours, your phone rings. A polite caller says he is from your bank. A "Credit Card Protection Plan" has been activated on your card, and you will be charged unless you cancel it today. He sends a link on WhatsApp so you can "deactivate" it.
That one call is the front door of CyberDakait, an organised fraud operation that has compromised at least 17,960 Android phones in India and intercepted more than 7.6 million SMS messages, including OTPs and bank alerts. The name fits. Dakait means bandit, and this group robs bank customers in broad daylight, using the customer's own phone.
On October 28, 2026, Group-IB's Threat Intelligence team published its investigation into this cluster. In this post I break down how the scam works, what sits under the hood, and what Indian banks, security teams and customers should do now.
Who is CyberDakait
CyberDakait is a financially motivated threat cluster focused only on India's financial sector. It is not one gang with one tool. Group-IB groups seven separate Android trojan families under one name because they share the same goal, the same phishing infrastructure and the same playbook. No individual or named group has been formally attributed yet.
Date | What happened |
Oct 28, 2026 | Group-IB publishes its CyberDakait investigation; malicious GitHub accounts are reported and deactivated |
Jul 2025 | Coordinated campaign activity against Indian banks begins, as tracked by Group-IB |
Jan 2025 | Earliest victim reports of the "Card Protection Plan" scam appear online |
2024 | Developers of one family (GhostBat) share screenshots of their tools in a Telegram chat |
The scale is what makes this campaign stand out.
Measure | Figure |
Compromised Android devices | 17,960 (2,364 via Telegram channels, 15,596 via exposed Firebase storage) |
SMS messages intercepted | 7,611,443 |
Indian banks impersonated | 11 |
Government programmes impersonated | 2 |
Trojan families | 7 |
Reported victim losses in documented cases | More than USD 30,500 |
The reported losses are only the cases victims made public. With 17,960 devices and millions of OTPs in the attackers' hands, the real number is almost certainly much higher.
The attack chain, step by step
The scam combines a phone call, a phishing website and malware. Each step looks harmless on its own.
The call. Shortly after a new card is issued, a caller posing as the bank says a Card Protection Plan has been activated automatically. The charge quoted ranges from about USD 5 to USD 150. The pressure is simple: cancel now or pay.
The link. The caller sends a link by WhatsApp or SMS to a bank-themed phishing page. The domains look official, with names built around words like "cancel", "card protection", "manage" and "service".
The silent download. Any button on the page, such as "Login Now" or "Activate Protection", silently downloads an APK. The file is hosted on GitHub, which helps it pass as legitimate and get past basic filters.
The fake update. Once installed, the app shows what looks like a Google Play update screen. In the background it installs a completely different app, the real trojan, along with a crypto-mining module.
The persistence trick. The app asks the user to disable battery optimisation "for normal functioning". This stops Android from killing the malware in the background.
The data harvest. A four-stage "deactivation" form collects the card number, expiry and CVV, then Net Banking credentials and card grid values under a KYC pretext, then mobile number, PAN and date of birth, and finally a photo of the card.
The takeover. The trojan intercepts every incoming SMS, including OTPs and transaction alerts, and forwards them to the attackers in near real time. It can also forward calls and send SMS from the victim's phone.
By the end, the attacker has the card, the banking login, the identity documents and the OTP. That is everything needed to empty an account.
Under the hood: seven trojans, one playbook
All seven families share the same packer, the same bank-themed lures and the same core abilities: SMS interception and forwarding, call forwarding, and card theft through phishing overlays. Where they differ is in how they talk to their operators. That difference is why Group-IB tracks them as separate projects inside one cluster.
Family | Main C2 channel | Notable commands |
cyb3rx | Telegram (check-in), remote server (C2) | Call forward on/off, custom USSD, send SMS, SMS forwarding |
GhostBat (also GhostGrab) | Telegram and Firebase | Call and SMS forwarding, keylogger, send SMS |
godz | Firebase and Telegram | Call forward, SMS forward, reset, send message |
d-passive | Firebase | Ping, start and stop core service |
tenxen | Firebase | Check, enable and disable call forwarding, forward SMS |
appkjl | Remote server | SMS, call and forwarding commands |
d-shine | Remote server | Basic check-in commands |
The free-to-use cloud stack. None of these families need expensive infrastructure. Telegram bots, Google Firebase and GitHub do the heavy lifting. This keeps costs low and makes blocking harder, because security teams cannot simply block these platforms.
Double income through cryptojacking. The dropper, known as d-miner, also installs an XMRig module that mines cryptocurrency on the victim's phone. It uses wake locks, a silent audio loop and a foreground service to keep running. Victims who notice battery drain and heating are seeing this in action. The attackers earn from the phone even when there is no bank fraud to commit.
An admin app for the attackers. One GitHub repository hosted a controller APK for the cyb3rx family. Operators use it to view stolen card data and SMS, switch SMS forwarding on and off, and send commands to each infected device. Its backend paths were organised by bank theme, which shows a separate campaign track for each bank being impersonated.
Malware built on a phone. Screenshots shared by GhostBat developers show them writing and compiling malware on Android phones, using mobile IDEs and APK editors. This lowers the barrier to entry. Anyone with a smartphone and some skill can join this ecosystem, which helps explain why so many families exist.
My analysis: what this campaign really tells us
The timing is the most worrying detail. Victims report getting the call within 24 hours of receiving a new card. Random calling cannot achieve that. The attackers appear to know who has just been issued a card. That points to leakage somewhere in the card issuance chain: a bank system, a card vendor, a dispatch or courier partner, or data resold from earlier breaches. The research does not say where this data comes from. Every issuing bank should be asking that question internally right now.
SMS OTP is no longer a strong second factor in India. Once a trojan reads every SMS on the device, the OTP protects nothing. 7.6 million intercepted messages show this is not theory. Banks that still treat SMS OTP as the final check for high-value actions are relying on a control that this campaign defeats by design.
Call forwarding is the quiet killer. Several families can switch on call forwarding through USSD commands. That means the bank's verification call, or the customer's own fraud alert call, can be silently diverted to the attacker. Very few banks monitor for this.
Trusted platforms are now the delivery network. GitHub for hosting, Firebase for data, Telegram for control. Blocking by domain reputation fails here because the domains are legitimate. Detection has to shift to behaviour: what the app does on the device and how the account behaves after it.
This is a social engineering problem first. No zero-day was needed. The victim installs the app because a convincing caller told them to. Technology controls matter, but customer awareness and fast bank response matter just as much. The lures also go beyond cards. Themes seen in the operator data include government benefit schemes and traffic challans, which widen the victim pool to people who do not even hold a credit card.
What banks and NBFCs should do now
Investigate the issuance data trail. Map every system and partner that knows when a card is issued and to whom. Check access logs, vendor contracts and data-sharing agreements. The 24-hour pattern is a lead worth chasing.
Warn customers at the right moment. Put a clear message in the card welcome kit, the activation SMS and the app: the bank will never call to cancel a protection plan, and will never send an APK link.
Move high-risk actions beyond SMS OTP. Use in-app authentication with device binding for card limit changes, beneficiary additions and large transactions.
Detect sideloaded and overlay malware. Add runtime protection to the mobile banking app to flag accessibility abuse, overlay windows and apps installed outside the Play Store.
Watch for call forwarding. Work with telecom operators to flag recent call-forwarding activation on the customer's number before trusting a voice verification.
Hunt lookalike domains and repositories. Monitor new domain registrations with your brand name and words like "cancel", "card protection" or "manage". Monitor GitHub for APKs using your brand, and report them fast.
Use behavioural fraud signals. A new device, a new SIM, a sudden limit change and a large transaction in a short window should trigger a hold, not an OTP.
Report and share. Report incidents to CERT-In and share indicators with peer banks. A cluster this size moves between banks quickly.
What SOC and digital forensics teams should do
For SOC teams. Load the published indicators into your SIEM, DNS filtering and threat intelligence platform. These include phishing domains, C2 IP addresses, mining pool hosts and APK hashes. For enterprises with mobile device management, block installation from unknown sources on corporate and BYOD phones. Alert on outbound traffic to the listed mining pools and C2 servers from mobile network segments.
For forensic investigators and cyber police teams. When a victim reports this fraud, the phone is your best evidence. Acquire it before it is reset.
Isolate the device from the network to stop further exfiltration, but do not factory reset it.
Take a forensic image and list all installed packages, with install source and install time.
Check for apps holding SMS, accessibility and battery optimisation exemptions.
Check call-forwarding status and recent USSD activity.
Extract configuration from the malicious APK: Telegram bot tokens, Firebase URLs and C2 addresses. These link the case to the wider cluster.
Preserve the WhatsApp chat, the caller number and the phishing URL with timestamps for the bank and law enforcement.
The full list of indicators of compromise is available in Group-IB's original report. A few examples of the phishing domains, shown defanged:
cancelcardprotection[.]online
deactivatecpplan[.]in
manageprotectionplan[.]in
What every bank customer should know
Share this section with family members. It is the part that saves money.
No bank asks you to install an app from a link. Banking apps come only from the Google Play Store or Apple App Store.
Hang up and call back. If someone calls about your card, end the call and dial the number printed on the back of your card.
Never share card details, CVV, grid values or OTPs. No genuine cancellation needs them.
Watch the warning signs. An app asking to read SMS, use accessibility features or ignore battery optimisation is a red flag. So is a phone that suddenly heats up or drains battery.
Check call forwarding. On most Indian networks, dialling *#21# shows whether your calls are being forwarded.
Act fast if something went wrong. Call your bank to block the card and freeze accounts, report the fraud on the national cyber crime helpline 1930 or cybercrime.gov.in, and keep the phone as it is for investigators.
The bottom line
CyberDakait shows how Indian banking fraud has industrialised. Seven malware families, free cloud platforms, malware written on phones and a scam script that works within a day of card issuance. The technology is ordinary. The organisation behind it is not.
GitHub has taken down the reported repositories, but this cluster has operated since at least January 2025 and will rebuild. The banks that act now on issuance data, SMS OTP dependence and customer warnings will see the next wave coming. The rest will read about it in their fraud reports.
If your team is dealing with a case linked to this campaign, I am happy to compare notes. Connect with me on LinkedIn.
Comments