Drinik Malware Targets Indian Taxpayers With Upgrades

CRIL analysis of the Drinik Android banking trojan documents an active campaign (since 2021) targeting Indian taxpayers and multiple banks; the malware evolved from SMS theft and phishing to advanced capabilities including MediaProjection-based screen recording, keylogging via Accessibility Service, CallScreeningService abuse to block incoming calls, and FCM-driven C2 commands. The report includes technical details of an analyzed APK, IOCs (file hashes, C2 URL and IPs), attack flow (phishing WebView loading genuine tax portal, harvesting biometric PIN and banking credentials), and mitigation recommendations.