PUBLIC-SAFE RUN REPORT
CyberDakait — Multi-Family Android Banking Fraud Cluster (India) — Mobile Fraud Intelligence (MFI)
Verified Findings
None
Contradictions / Caveats
- UNKNOWN: Group-IB documented CyberDakait as an analytical cluster targeting Indian financial services with seven technically distinct Android Trojan families, at least 17,960 compromised devices across two telemetry vectors, 7,611,443 intercepted SMS messages, 11 banks and 2 government programs impersonated, and malware-assisted banking fraud using social-engineering delivery plus SMS/OTP, call-forwarding and credential/card-data theft.
- Evidence boundary: One codebase, conclusively one operator, Jordan/MENA activity, SIM/eSIM, NFC relay, app cloning or identity with Jordan wallet cases.
- UNKNOWN: CYFIRMA independently documented GhostGrab as Android banking/data-stealing and cryptomining malware using Firebase with SMS/OTP theft, call-forwarding capability and banking/KYC phishing, supporting pre-2026 family continuity.
- Evidence boundary: The 2026 CyberDakait cluster attribution, 17,960-device denominator, common operator or Jordan/MENA activity.
- UNKNOWN: Cyble independently documented GhostBat using fake RTO/mParivahan themes, GitHub-hosted APK delivery, a fake-update flow, Telegram/Firebase telemetry, UPI/banking credential theft and SMS/OTP collection.
- Evidence boundary: The full 2026 cluster, all seven families, common operator, combined victim denominator or Jordan/MENA targeting.
Open Follow-up
- OPEN [HIGH]: CLUSTER_OPERATOR_IDENTITY — Definitive common-operator proof across all seven CyberDakait families remains missing.
- OPEN [HIGH]: JORDAN_MENA_PROJECTION — No direct Jordan/MENA victim telemetry, bank/provider logs, local IOC hits, transaction authorization-path evidence or authority attribution ties CyberDakait to the region.