SMS Stealer Phishing Campaign Hits Indonesia's BRI Bank

This report documents a phishing campaign targeting Bank Rakyat Indonesia (BRI) in which threat actors distribute Android SMS-stealer malware (a custom 'Brimo' sample and an SmsEye-based sample) via malicious APKs to harvest banking credentials and automatically exfiltrate OTPs to bypass 2FA; the analysis includes APK metadata, manifest and source-code observations, C2/Telegram exfiltration details, hashes and phishing URLs, MITRE ATT&CK mappings, and recommended mitigations.