Indian Banking Customers Fall for SMS Scams

Zscaler ThreatLabz observed active SMS-based phishing campaigns targeting customers of major Indian banks (HDFC, Axis, SBI) that distribute Android malware via fake card-update and KYC pages; the malware harvests card details and personal data through in-app or remote-rendered phishing pages, requests SMS permissions to intercept OTPs, exfiltrates data to command-and-control servers, employs cloaking to avoid repeat display, and the report includes multiple IOCs (domains and MD5 hashes) and detection notes.