KYCShadow: Mobile Threat Alert – Android Banking Malware Campaign

CYFIRMA Research has identified a sophisticated Android malware campaign distributed via WhatsApp, impersonating Bank KYC and e-Challan services to compromise financial users at scale.

The campaign demonstrates structured backend operations and infrastructure reuse (e.g., jsonapi[.]biz), indicating a coordinated and evolving fraud ecosystem. Notably, phishing interfaces reuse “eChallan” themes, reflecting cross-campaign adaptation techniques.

Link to the Research Report: https://www.cyfirma.com/research/kycshadow-an-android-banking-malware-exploiting-fake-kyc-workflows-for-credential-and-otp-theft/

#ThreatIntelligence #AndroidMalware #BankingFraud #CyberSecurity #MobileThreats #MalwareAnalysis #ThreatResearch #CYFIRMA #CYFIRMAresearch

https://www.cyfirma.com/