New Android Banking Malware Abuses Fake KYC Workflow and WhatsApp Delivery to Hijack Accounts

KYCShadow is an Android banking malware campaign targeting Indian bank customers via WhatsApp-distributed fake KYC apps; it employs a two-stage dropper to silently install a hidden secondary payload that requests SMS/call permissions, intercepts OTPs, registers with Firebase C2, and routes traffic through an attacker-controlled VPN (domains observed include jsonapi.biz), enabling credential theft and persistent remote control.