TOPIC
Operational Android banking-fraud MaaS targeting Indian bank customers; research question separates platform operation, scale, compound OTP/call-forward bypass, operator identity and regional projection.
1
3
3
3
3
NEW — CloudSEK primary operational telemetry verified; independent technique/campaign comparators recovered; same-cluster independence and Jordan/MENA attribution remain gated.
MOBILE_BANKING_FRAUD_RESEARCH_TOPIC
—
—
—
MR ROBOT is an operational Android banking-fraud MaaS with observed affiliate/device telemetry and a reusable service/control plane; evidence supports platform operation but not a global victim or monetary-loss denominator.
Independent same-cluster telemetry, infrastructure continuity, affiliate population and provider loss data.
Hidden call forwarding combined with SMS/OTP interception creates a compound verification-bypass path that can divert bank fraud-check calls while capturing transaction-authentication data.
Per-victim call-forward state, OTP timeline, bank callback logs and transaction authorization path.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 3 Evidence
CloudSEK documented a previously unreported Android Malware-as-a-Service operation targeting Indian bank customers with bank-specific/custom APK builds, SMS/OTP interception, hidden unconditional call forwarding, banking/payment credential theft and observed affiliate/device telemetry.
لا يثبت: Independent same-cluster corroboration, operator identity, global victim/loss totals, full affiliate population, or Jordan/MENA activity.
فتح Run المصدرZimperium independently documented RedWing Android MaaS with SMS/credential theft, remote control and hidden unconditional call forwarding using *21* USSD, providing an independent technical precedent for the compound call-diversion/authentication-data theft mechanism.
لا يثبت: MR ROBOT identity, operator, infrastructure, victim counts or code lineage.
فتح Run المصدرMyCERT documented an active sideloaded Android banking-RAT campaign using social/WhatsApp lures, Accessibility overlays, SMS OTP interception, remote control and unauthorized transfers from the victim's enrolled device.
لا يثبت: MR ROBOT identity/shared operator/infrastructure or Jordan/MENA activity.
فتح Run المصدرMR ROBOT is defensively relevant to Jordan/MFI because its mechanics overlap active watch signals, but no Jordan/MENA campaign attribution is established.
Jordan/MENA victim samples, package/signing/C2 matches, telecom call-forward telemetry, bank/provider logs and authoritative reporting.
Independent same-cluster telemetry or infrastructure evidence for MR ROBOT was not recovered; most public same-cluster coverage is derivative of the CloudSEK origin.
Independent malware/sample analysis, infrastructure ownership/history, provider/bank telemetry or separate victim/affiliate datasets.
The relationship between MR ROBOT and RedWing/FatBoyPanel remains unproven beyond overlapping MaaS and mobile-banking-fraud techniques.
Shared code provenance, signer/build lineage, administrative infrastructure, operator handles, licensing backend or independently linked monetization infrastructure.
No direct Jordan/MENA victim telemetry, bank/provider logs, matched IOCs or authority attribution links MR ROBOT to the region.
Jordan/MENA victim APK/package/signing/C2 evidence, telecom call-forward logs, bank/provider session/transaction telemetry, IOC matches or authoritative incident reporting.
JORDAN_MENA_PROJECTION