Banking Trojans Actively Targeting Indian Financial Institutions

Private: Best Cybersecurity Practices During Geopolitical Conflicts

Tools like Cerberus and Anubis are being spread via smishing (SMS phishing)
campaigns that mimic RBI, SBI, and UPI portals.
These trojans steal login details, intercept OTPs, and enable fraudulent
transfers while appearing invisible to users.
Immediate Actions for Individuals & Businesses:
– Audit All Installed Apps: Especially anything recently downloaded or
sideloaded via Telegram channels or unofficial sites. Remove anything
suspicious.
– DNS and Endpoint Monitoring: Watch for anomalies like connections
to .ru, .pk, or recently registered domains.
– Limit International Access on Firewalls & Servers: Geo-block traffic from
high-risk regions if not required for business.
– Disable Macros & Auto-Open on Office Files: Prevent silent execution of
malicious code in shared documents.
– Verify Before You Trust: Cross-check “alerts,” “leaks,” and forwarded
files. Disinfo operations are in full swing.
Mobile Surveillance via Infected APKs
– Apps disguised as Indian news, war updates, or fake CBSE/Sarkari result
apps.
– Location tracking, audio recording, and exfiltration of personal data. – Prohibit sideloading; deploy MDM with app whitelisting.