# MR ROBOT Malware-as-a-Service Threatens Indian Banking Sector

*Published October 30, 2026*
*Source: [https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/](https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/mr-robot-malware-as-a-service-threatens-indian-banking-sector) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A newly identified Android malware-as-a-service operation, known as MR ROBOT, is targeting Indian bank customers by renting customized banking trojans to cybercriminals. Detailed research conducted by CloudSEK on October 28 uncovered this operation, which involves an operator control panel, a Telegram-based storefront, and a malware builder. These tools enable affiliates to create Android trojans that mimic legitimate banking apps, allowing them to intercept sensitive information. The malware is distributed through deceptive Play Store-style websites and messaging-app links, impersonating banks, utility providers, and even government services.

MR ROBOT is not the work of a single actor but rather a multi-tenant crimeware platform. Affiliates receive individual application IDs and can generate Android packages that impersonate specific Indian banks. The platform operates under a reseller model with sub-admin accounts, and affiliates can license access for specific durations through a control panel, currently at version 7.0. The malware is capable of intercepting text messages, including one-time passwords, displaying counterfeit screens to gather banking credentials, and silently enabling call forwarding to reroute important calls to numbers controlled by attackers.

CloudSEK's research traced two affiliates using this platform. One affiliate's control panel contained around 154 compromised devices and intercepted approximately 3270 messages. Another affiliate's exposed Firebase database revealed 153 devices and 5407 intercepted messages. Data collection occurred between July 16 and 30, 2026, with about 4000 messages originating from bank and telecommunications short codes. Alarmingly, call forwarding was enabled on 58% of the affected devices.

Each malware build receives a new signing certificate and can conceal itself from the Android launcher post-installation. CloudSEK noted that MR ROBOT shares some features with other operations like FatBoyPanel and RedWing, but its specific tools and infrastructure had not been previously documented. To mitigate this threat, CloudSEK recommends users avoid installing bank-branded apps from SMS or messaging app links and suggests banks transition from text-message OTPs to app-based or Fast Identity Online authentication methods.