Cyberattackers Use Fake RTO Challan Alerts to Spread Android Malware

Seqrite Labs discovered a sophisticated Android malware campaign impersonating RTO challan notifications distributed via WhatsApp that uses a three-stage modular architecture: an initial dropper with a cryptominer, a persistence/backend-initialization stage using Firebase, and a final data-theft/surveillance stage that prompts victims for high-risk permissions. The campaign exfiltrates OTPs, banking credentials, Aadhaar/PAN details, and other sensitive data to attacker-controlled servers, enables remote C2 operations (including SMS forwarding and tracking), infected roughly 7,400 devices, and facilitates large-scale financial fraud and identity theft.