Attackers Mimic RTO Challan Notifications to Deliver Android Malware

An active Android malware campaign is distributing sideloaded fake Regional Transport Office (RTO) "E-Challan" apps via WhatsApp and SMS to Indian users; the multi-stage malware leverages social engineering, requests dangerous permissions, implements anti-analysis techniques and a custom VPN tunnel to harvest banking messages, OTPs, and personal metadata, maintain persistence, and enable large-scale financial fraud and identity theft. Users are advised to avoid installing apps outside official stores and verify fines via official government websites, while organizations should deploy mobile threat defense and security awareness training.