{"id":178888,"date":"2023-12-20T07:40:59","date_gmt":"2023-12-20T15:40:59","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=178888"},"modified":"2024-06-05T10:53:50","modified_gmt":"2024-06-05T17:53:50","slug":"shielding-against-android-phishing-in-indian-banking","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/","title":{"rendered":"Shielding Against Android Phishing in Indian Banking"},"content":{"rendered":"<p><em>Authored by Neil Tyagi and Fernando Ruiz<\/em><\/p>\n<p>In a digitally evolving world, the convenience of banking through mobile applications has revolutionized financial transactions. However, this advancement has also opened doors to a lesser-known adversary: Android phishing. Join us as we delve into the clandestine realm of cyber threats targeting India&#8217;s banking sector.<\/p>\n<p>This blog uncovers the nuances of an Android phishing\/banking trojan application identified as Android\/Banker.AFX illustrates a common procedure from cybercriminals designed to drain the bank accounts of their victims:<\/p>\n<p>First broadcasting phishing messages via WhatsApp and luring users to install an app that carries malicious code hidden as a verification tool. Once installed, the banking trojan can collect personal and financial information plus intercept SMS messages with the objective of stealing one-time passwords or verification codes that are required to complete transactions which may lead to stealing the banking account assets.<\/p>\n<p>This trojan is just a variant and example of multiple banking trojans implementations recently observed in the wild that carry similar risks, which is not technically sophisticated but might be very effective and prevalent especially when it\u2019s widely distributed on social media. McAfee Mobile Security protects broadly and generically against this type of banking trojans.<\/p>\n<p>This blog explores the insidious tactics, alarming trends, and preventive measures against the rising tide of phishing attacks plaguing Android users in India\u2019s financial landscape.<\/p>\n<h2>Distribution Method: Messaging platforms<\/h2>\n<ul>\n<li>The initial lure is an alarming WhatsApp message prompting the user to download an Android Package (APK) to complete a mandatory verification procedure carried out by financial institutions known as Know Your Customer (KYC) else the account would be blocked.<\/li>\n<\/ul>\n<p><strong> <img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-178889 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_1-1.png\" alt=\"\" width=\"438\" height=\"779\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_1-1.png 438w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_1-1-169x300.png 169w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_1-1-73x129.png 73w\" sizes=\"auto, (max-width: 438px) 100vw, 438px\" \/><\/strong><\/p>\n<p>A sense of urgency is created for the user by warning him that the account would be blocked if he doesn&#8217;t install the APK and provide the necessary information to complete the KYC form.<\/p>\n<p>These seemingly innocent prompts, meticulously crafted by cybercriminals, possess a cunning sophistication that mirrors the legitimate communication channels of banking institutions. They prey upon human curiosity, fear, and desire, tricking users into taking immediate actions that, at first glance, seem innocuous but have far-reaching consequences.<\/p>\n<h2>Installation and execution<\/h2>\n<p>Since the app installer is triggered by Whatsapp, the installation by default should be blocked by Android unless the user previously allowed the installation of unknown apps from this source.<\/p>\n<p>A warning is displayed after taping on the APK icon:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-178903 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_2-1.png\" alt=\"\" width=\"792\" height=\"394\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_2-1.png 792w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_2-1-300x149.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_2-1-768x382.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_2-1-205x102.png 205w\" sizes=\"auto, (max-width: 792px) 100vw, 792px\" \/><\/p>\n<p>However, if users ignore the warning, they may deactivate this important security feature with just two clicks:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-178917 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_3-1.png\" alt=\"\" width=\"907\" height=\"1811\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_3-1.png 907w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_3-1-150x300.png 150w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_3-1-513x1024.png 513w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_3-1-768x1533.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_3-1-769x1536.png 769w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_3-1-65x129.png 65w\" sizes=\"auto, (max-width: 907px) 100vw, 907px\" \/><\/p>\n<p>Now Android OS is warning about the risk of allowing the installation of unknown apps from WhatsApp. However, many users allow this option, which poses a high risk of infection.<\/p>\n<p>Once the Trojan is installed, the victims will get the financial institution icon on their Android app list:<\/p>\n<p><strong> <img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-178931 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_4-1.png\" alt=\"\" width=\"446\" height=\"498\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_4-1.png 446w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_4-1-269x300.png 269w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_4-1-116x129.png 116w\" sizes=\"auto, (max-width: 446px) 100vw, 446px\" \/><\/strong><\/p>\n<p>After installation, it abuses the icon of SBI to confuse the user.<\/p>\n<p><strong> <img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-178945 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_5-1.png\" alt=\"\" width=\"469\" height=\"503\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_5-1.png 469w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_5-1-280x300.png 280w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_5-1-120x129.png 120w\" sizes=\"auto, (max-width: 469px) 100vw, 469px\" \/><\/strong><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-178973 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_7-1.png\" alt=\"\" width=\"390\" height=\"799\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_7-1.png 390w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_7-1-146x300.png 146w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_7-1-63x129.png 63w\" sizes=\"auto, (max-width: 390px) 100vw, 390px\" \/><\/p>\n<p>Opening for the first time, it asks for SMS-related permissions.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-179001 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_9.png\" alt=\"\" width=\"305\" height=\"448\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_9.png 305w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_9-204x300.png 204w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_9-88x129.png 88w\" sizes=\"auto, (max-width: 305px) 100vw, 305px\" \/><\/p>\n<p>The application&#8217;s landing page is similar to the net banking page of Real SBI.<br \/>\nThis phishing site is locally loaded from the malware into a WebView.<\/p>\n<p>The application asks for the user&#8217;s username, password, and phone number.<\/p>\n<p>The Captcha used here is static. It does not change ever because all content is hardcoded locally.<\/p>\n<p>As part of the KYC validation lure process, the malware collects sensitive user information such as:<\/p>\n<ul>\n<li>Full Name, Date of Birth<\/li>\n<li>Account, CIF, PAN, and Aadhar Numbers<\/li>\n<li>Credit card information<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-178987 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_8-1.png\" alt=\"\" width=\"499\" height=\"815\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_8-1.png 499w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_8-1-184x300.png 184w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_8-1-79x129.png 79w\" sizes=\"auto, (max-width: 499px) 100vw, 499px\" \/><\/p>\n<p>After the victim inputs all the information, they are presented with a fake KYC validation code, which makes it look like a genuine procedure the user might not be suspicious about the app or the process.<\/p>\n<p>Additionally, this banking trojan intercepts SMS messages and abuses Firebase to communicate with attackers. During the analysis the malware transmitted all collected information including credit card information to:<\/p>\n<p><em>wss[:]\/\/s-usc1a-nss-2003.firebaseio.com\/.ws?v=5&amp;ns=zero-a4c52-default-rtdb <\/em><\/p>\n<p>According to the static analysis, any received SMS message would also be exfiltrated to the attackers\u2019 servers via the opened socket communication since the app has granted SMS reading permissions at the first execution. This is implemented to extract any OTP required to complete transactions of the victim.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-179015 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_10.png\" alt=\"\" width=\"624\" height=\"698\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_10.png 624w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_10-268x300.png 268w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_10-115x129.png 115w\" sizes=\"auto, (max-width: 624px) 100vw, 624px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>Exfiltrated credit card information from the local static site loaded by the malware abuses the \u00a0Cordova framework. Credit card information, along with all collected information, is transmitted to the attackers using Firebase, a legitimate service that\u2019s also abused by criminals.<\/p>\n<p><strong><u>\u00a0<\/u><\/strong><\/p>\n<h2>Static Analysis<\/h2>\n<p><strong>\u00a0<\/strong><\/p>\n<ul>\n<li>This malware requires common permissions however it\u2019s important to highlight that RECEIVE_SMS is a very dangerous permissions that should only be granted to apps that are related to messaging that you trust. If apps installed from third-party sources require it, it\u2019s a red flag:\n<ul>\n<li>INTERNET<\/li>\n<li>REQUEST_INSTALL_PACKAGES<\/li>\n<li>RECEIVE_SMS<\/li>\n<li>ACCESS_NETWORK_STATE<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul>\n<li>Information collected by the phishing site:<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>username<\/li>\n<li>password<\/li>\n<li>phone number<\/li>\n<li>date of birth<\/li>\n<li>account number<\/li>\n<li>CIF number<\/li>\n<li>pan number<\/li>\n<li>debit card number<\/li>\n<li>CVV number<\/li>\n<li>atm pin<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li>The main package goes by the name of hello.uwer.hello.hello.google.is.the.best, which contains the MainActivity for APK: The First oncreate function prompts for SMS read permission from the user, and when the user gives the permission, the user is greeted with the message &#8220;thank you -Team SBI&#8221; else &#8220;We can&#8217;t verify until you allow -Team Bank&#8221;<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-179029 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_11.png\" alt=\"\" width=\"944\" height=\"386\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_11.png 944w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_11-300x123.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_11-768x314.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_11-205x84.png 205w\" sizes=\"auto, (max-width: 944px) 100vw, 944px\" \/><\/p>\n<ul>\n<li>The read message permission is required to monitor any incoming messages, preferably OTPs, so those can be forwarded to the attacker to gain access to the account, bypassing any OTP-based 2-factor authentications.<\/li>\n<li>All incoming messages are saved to the database and later forwarded to the attacker.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-179043 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_12.png\" alt=\"\" width=\"692\" height=\"307\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_12.png 692w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_12-300x133.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_12-205x91.png 205w\" sizes=\"auto, (max-width: 692px) 100vw, 692px\" \/><\/li>\n<li>The Firebase configuration is stored in the APK along with the API key.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-179057 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_13.png\" alt=\"\" width=\"873\" height=\"558\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_13.png 873w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_13-300x192.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_13-768x491.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_13-202x129.png 202w\" sizes=\"auto, (max-width: 873px) 100vw, 873px\" \/><\/li>\n<li>Debit\/credit card information is being submitted using Firebase.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-179071 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_14.png\" alt=\"\" width=\"900\" height=\"780\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_14.png 900w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_14-300x260.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_14-768x666.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/Figure_14-149x129.png 149w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/li>\n<li>The user&#8217;s Aadhar number, CIF (customer information file), and user information are collected and submitted to Firebase.<\/li>\n<\/ul>\n<h2>Telemetry And Safety by Mcafee<\/h2>\n<ul>\n<li>McAfee Mobile Security proactively protects against this threat as Android\/Banker.AXF!ML.<\/li>\n<li>McAfee has prevented over 360 device infections of Android\/Banker.AXF!ML in the last 30 days. India underscores the acute threat posed by this banking malware within the country&#8217;s digital landscape, with few hits found elsewhere in the world, possibly from Indian SBI users Living in Other Countries.<\/li>\n<\/ul>\n<p>Android\/Banker.AXF!ML infections around the world: India is the target.<\/p>\n<ul>\n<li>The proactive stance taken by McAfee against Android\/Banker.AXF!ML underscores its commitment to shielding users from the ever-evolving landscape of Android-based phishing and banking threats, emphasizing the importance of robust cybersecurity measures in safeguarding the integrity of personal financial data.<\/li>\n<\/ul>\n<h2>Conclusion<\/h2>\n<p>Banking trojans are not new or sophisticated but they are a persistent threat due to the lucrative business that poses for malware authors which can lure many victims that are unaware of the risk of phishing. As these campaigns can be massive even if a small percentage of targeted victims fall the criminals can have a large loot.<\/p>\n<p>Cybercriminals are constantly improving their social engineering tricks to lure users into phishing and malware. The first line of defense against these threats is the user\u2019s awareness. Some generic advises are:<\/p>\n<ul>\n<li>Avoid installing apps from third party sources, especially apps received by messaging apps.\n<ul>\n<li>Do not activate \u201cinstall unknown apps\u201d option on social media apps.<\/li>\n<\/ul>\n<\/li>\n<li>Do not trust or click on messages received from untrusted sources in social media.<\/li>\n<li>For banking apps stick into the official website and officials\u2019 apps stores<\/li>\n<li>If possible, use a reliable antivirus solution such as McAfee Mobile Security which generically protects against these types of threats.<\/li>\n<\/ul>\n<p>McAfee Antivirus emerges as a formidable ally in the battle against Android phishing within India&#8217;s banking sector. With its robust suite of security features tailored for mobile devices, McAfee stands as a bulwark, providing critical defense mechanisms against the ever-mutating landscape of cyber threats.<\/p>\n<h2>Indicators Of compromise<\/h2>\n<table width=\"769\">\n<tbody>\n<tr>\n<td width=\"491\">Hash<\/td>\n<td width=\"278\">Package<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">7cfc6360e69d22b09a28c940caf628959d11176e27b8a03e15b020b369569415<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">b067f5903e23288842ad056d4b31299b3b30052abe69bee236136b2b9fcab6a8<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">e2e097ef433be75dcab830baa4b08feb4a24267c46b568fd4aef00dbb081ed8f<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">9f046f769760d52a97680a91fd511f1e86c428b9eec27d7eb486b7b4d0666f0b<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">1c69b0a69ed1631a1f1b54627a9b5dac3b214a275280de36d05ee75021cbfb04<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">495ab4efd3d1ec9bfc2d08d80df316aad20dc76e625374627fabea06f5151584<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">6190144b56e06af8aeeeba2104a665a555d01f6ec2a22ba78212d943ac2b258d<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<tr>\n<td width=\"491\">6c6ea9fbeae967fb53ab9984edda9b754fb6d3f85b4ff5b14e1fd33399362ba4<\/td>\n<td width=\"278\">hello.uwer.hello.hello.google.is.the.best<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p><u>Abused Firebase host : <\/u><em>Wss[:]\/\/s-usc1a-nss-2003.firebaseio.com\/.ws?v=5&amp;ns=zero-a4c52-default-rtdb <\/em><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Authored by Neil Tyagi and Fernando Ruiz In a digitally evolving world, the convenience of banking through mobile applications has&#8230;<\/p>\n","protected":false},"author":695,"featured_media":179085,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[4136],"class_list":["post-178888","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Shielding Against Android Phishing in Indian Banking | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Authored by Neil Tyagi and Fernando Ruiz In a digitally evolving world, the convenience of banking through mobile applications has revolutionized\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Shielding Against Android Phishing in Indian Banking | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Authored by Neil Tyagi and Fernando Ruiz In a digitally evolving world, the convenience of banking through mobile applications has revolutionized\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-12-20T15:40:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-06-05T17:53:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Shielding Against Android Phishing in Indian Banking\",\"datePublished\":\"2023-12-20T15:40:59+00:00\",\"dateModified\":\"2024-06-05T17:53:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/\"},\"wordCount\":1509,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png\",\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/\",\"name\":\"Shielding Against Android Phishing in Indian Banking | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png\",\"datePublished\":\"2023-12-20T15:40:59+00:00\",\"dateModified\":\"2024-06-05T17:53:50+00:00\",\"description\":\"Authored by Neil Tyagi and Fernando Ruiz In a digitally evolving world, the convenience of banking through mobile applications has revolutionized\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Shielding Against Android Phishing in Indian Banking\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Shielding Against Android Phishing in Indian Banking | McAfee Blog","description":"Authored by Neil Tyagi and Fernando Ruiz In a digitally evolving world, the convenience of banking through mobile applications has revolutionized","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Shielding Against Android Phishing in Indian Banking | McAfee Blog","og_description":"Authored by Neil Tyagi and Fernando Ruiz In a digitally evolving world, the convenience of banking through mobile applications has revolutionized","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2023-12-20T15:40:59+00:00","article_modified_time":"2024-06-05T17:53:50+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png","type":"image\/png"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Shielding Against Android Phishing in Indian Banking","datePublished":"2023-12-20T15:40:59+00:00","dateModified":"2024-06-05T17:53:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/"},"wordCount":1509,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png","articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/","name":"Shielding Against Android Phishing in Indian Banking | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png","datePublished":"2023-12-20T15:40:59+00:00","dateModified":"2024-06-05T17:53:50+00:00","description":"Authored by Neil Tyagi and Fernando Ruiz In a digitally evolving world, the convenience of banking through mobile applications has revolutionized","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/12\/300x200_Blog_112923.png","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/shielding-against-android-phishing-in-indian-banking\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Shielding Against Android Phishing in Indian Banking"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/178888","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=178888"}],"version-history":[{"count":29,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/178888\/revisions"}],"predecessor-version":[{"id":179100,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/178888\/revisions\/179100"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/179085"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=178888"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=178888"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=178888"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=178888"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}