MR ROBOT — Android Banking Malware-as-a-Service / India — Mobile Fraud Intelligence (MFI)
PASSNot recorded
Date
1 Nov 2026
Domain
Mobile Fraud Intelligence (MFI)
Topic
MR ROBOT — Android Banking Malware-as-a-Service / India
Status
PASS
Verified Findings
None
Contradictions / Caveats
UNKNOWN: CloudSEK documented a previously unreported Android Malware-as-a-Service operation targeting Indian bank customers with bank-specific/custom APK builds, SMS/OTP interception, hidden unconditional call forwarding, banking/payment credential theft and observed affiliate/device telemetry.
Evidence boundary: Independent same-cluster corroboration, operator identity, global victim/loss totals, full affiliate population, or Jordan/MENA activity.
UNKNOWN: Zimperium independently documented RedWing Android MaaS with SMS/credential theft, remote control and hidden unconditional call forwarding using *21* USSD, providing an independent technical precedent for the compound call-diversion/authentication-data theft mechanism.
UNKNOWN: MyCERT documented an active sideloaded Android banking-RAT campaign using social/WhatsApp lures, Accessibility overlays, SMS OTP interception, remote control and unauthorized transfers from the victim's enrolled device.
Evidence boundary: MR ROBOT identity/shared operator/infrastructure or Jordan/MENA activity.
Open Follow-up
OPEN [HIGH]: SAME_CLUSTER_CORROBORATION — Independent same-cluster telemetry or infrastructure evidence for MR ROBOT was not recovered; most public same-cluster coverage is derivative of the CloudSEK origin.
OPEN [HIGH]: OPERATOR_CODE_LINEAGE — The relationship between MR ROBOT and RedWing/FatBoyPanel remains unproven beyond overlapping MaaS and mobile-banking-fraud techniques.
OPEN [HIGH]: JORDAN_MENA_PROJECTION — No direct Jordan/MENA victim telemetry, bank/provider logs, matched IOCs or authority attribution links MR ROBOT to the region.