Fake Card-Protection Calls Plant Bank Trojans on 18,000 Indian Phones
Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.
A fake “card protection plan” phone call is the opening move in a scheme that has infected nearly 18,000 Android phones in India with banking trojans, Group-IB reports. The firm tracks the financially motivated cluster as CyberDakait and sorted its malware into seven families that steal card details, read one-time passcodes and quietly forward calls and texts. It counted more than 7.6 million intercepted SMS messages.
For defenders
The lure: Callers posing as bank staff, often within a day of a customer getting a new card, say a “Credit Card Protection Plan” was switched on and will cost roughly $5 to $150 unless cancelled. Texts, WhatsApp messages and calls point to bank-themed phishing pages. A button such as “Activate Protection” downloads an APK hosted on GitHub, which shows a fake Google Play update screen while installing a different app and asks the user to turn off battery optimization so it keeps running. The pages then collect card number, expiry and CVV, net banking login and grid card values, mobile number, PAN and date of birth, and a photo of the card.
The malware: Group-IB names seven families: cyb3rx, appkjl, godz, d-passive, d-shine, GhostBat (also called GhostGrab) and tenxen. They share SMS interception and forwarding, sending SMS, call forwarding and phishing overlays for card theft, and report to Telegram bots, Firebase or PHP panels. A related dropper installs an XMRig-based cryptominer. The firm says the families likely share an origin but may be separate projects, since their C2 formats differ. Eleven Indian banks and two government programs were impersonated; reported incidents add up to more than $30,500 in losses. Group-IB had the GitHub accounts taken down. The report doesn’t map the behavior to ATT&CK.
A sample of Group-IB’s indicators (the report has 70+ phishing domains and 30+ APK hashes):
cancelcardprotection[.]online
deactivatecpplan[.]in
cardsprotection[.]in
managecp[.]com
idfcare[.]in
fud2026[.]com
install-update[.]xyz
update-app[.]online
64.89.163[.]3
78.159.156[.]74
144.31.244[.]184
46.151.182[.]28cyb3rx 0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856
godz 9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8
GhostBat 43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6
tenxen d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f
d-shine 3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc
appkjl 555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd1bdeb843570fWhat it means for you
Your bank won’t call to cancel a “protection plan” by having you install an app. Once one of these apps is on your phone, it can read the passcodes your bank texts you and send your calls elsewhere, so the criminals can approve payments and dodge the bank’s check-in call. The scam targets Indian bank customers, but the same trick works anywhere banks use text-message codes.
Do this now
- Hang up on unexpected calls about card charges and call the number printed on the back of your card.
- Install apps only from Google Play; never from a link in a text, WhatsApp message or web page.
- Refuse any app that asks for Accessibility access or permission to read your SMS unless you know exactly why it needs it.
- If you installed one, call your bank to freeze cards and accounts, then reset the phone or have it checked.
Source article: False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps
Publisher: Group-IB (authors: Mahima, Cyber Intelligence Analyst; Ngo Thanh Van, Malware Analyst)
Published: October 28, 2026
URL: https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/
Executive Summary
Group-IB tracks CyberDakait, a financially motivated cluster targeting customers of Indian banks with seven Android trojan families: cyb3rx (labelled “cyberx” in the IOC list), appkjl, godz, d-passive, d-shine, GhostBat (Group-IB treats GhostGrab, reported by CYFIRMA in October 2025, as its older version) and tenxen, plus a dropper Group-IB calls d-miner that carries an XMRig-based cryptominer and a RAT. Group-IB says the families differ in network protocol, database schema and Telegram message format and share no direct code lineage, so they may be separate projects under one umbrella. Activity dates to at least January 2025. The chain starts with a phone call from someone posing as bank staff, often within 24 hours of a new card being issued, claiming a “Credit Card Protection Plan” was auto-activated and will be charged unless cancelled. The caller sends a WhatsApp link to a bank-themed phishing page; a button such as “Activate Protection” silently downloads an APK hosted on GitHub, which shows a fake Google Play update screen while installing a different app and asks the user to disable battery optimization. The pages collect card number, expiry, CVV, net-banking credentials and grid values, mobile number, PAN, date of birth and a photo of the card, while the trojan intercepts and forwards SMS (including OTPs), sends SMS, and turns on call forwarding so the bank’s verification calls go elsewhere. Command and control runs over Telegram bots, Firebase and PHP panels. Group-IB counted 17,960 compromised devices, 7,611,443 intercepted messages, 11 impersonated banks and two government programs, and more than $30,500 in reported losses. Hunt leads, false-positive expectations and indicators are detailed below; Group-IB published no YARA, Sigma or ATT&CK mapping, and the Enterprise ATT&CK matrix used here has no technique for on-device SMS interception or call forwarding, so those behaviors are noted as unmapped.
ATT&CK chain: Resource Development → Initial Access → Execution → Command and Control → Impact
Hunt Lead Grid
| Hunt Lead Level | Hunt Lead Name | ATT&CK | Risk of False Positives |
|---|---|---|---|
| 1 (Junior) | CyberDakait Phishing Domain and GitHub Account Sweep | T1566.002 (Phishing: Spearphishing Link), T1608.001 (Stage Capabilities: Upload Malware) | Low for the exact domains and GitHub account names; High if broadened to github.io or github.com as a whole, which developers use constantly, so the sweep anchors on the listed account names and hostnames. |
| 1 (Junior) | C2 and Mining Infrastructure Sweep | T1071.001 (Application Layer Protocol: Web Protocols), T1496 (Resource Hijacking) | Low. The IPs and fud2026 hostnames are attacker-run per Group-IB; the sweep anchors on exact IPs and ports (8082, 8443, 9000) rather than on shared hosting ranges. |
| 2 (Pro) | Panel Endpoint Path Patterns | T1071.001 (Application Layer Protocol: Web Protocols) | Medium. Names like message.php and add_sms.php also exist on legitimate SMS gateways, so the rule anchors on the exact path combinations and parameters Group-IB documents and on Android/Dalvik user agents. |
| 2 (Pro) | APK Download Off a Bank-Themed Page | T1204.002 (User Execution: Malicious File) | Medium. Developers and testers download APKs from GitHub legitimately, so the rule anchors on the download being referred by a newly seen domain with card, protection, cancel or manage themes on a phone, not a build host. |
| 3 (Elite) | Sideloaded SMS-Reading App Talking to Telegram or Firebase | T1102 (Web Service) | Medium. Many legitimate apps use Firebase and some use Telegram, so the correlation requires all three: an app installed outside Google Play, SMS or call-forwarding permissions, and traffic to Telegram’s bot API or a Firebase project not tied to an approved app. |
CyberDakait Phishing Domain and GitHub Account Sweep
Group-IB lists more than 70 phishing domains built around card-protection and service themes, for example cancelcardprotection[.]online, deactivatecpplan[.]in, cardsprotection[.]in, cardsprotection[.]online, managecp[.]com, managecp[.]co[.]in, idfcare[.]in, careidf[.]online, policydeactivate[.]in, protectcc[.]online, manageprotectionplan[.]in and imobileservices[.]online, plus GitHub Pages hosts hamzaansari1612-ux[.]github[.]io, rohansingh253641-spec[.]github[.]io and suraj527526-cmyk[.]github[.]io. The APKs themselves were hosted under 16 GitHub accounts, including muhaamad852-netizen, gopalmalo36374-beep, rahul3555899-prog, asdg18982-netizen, ranidevisingh901-debug (which also hosted the cyb3rx admin APK in the repository gsafsdfsdf), arushkumar8012-hub, dapu72979-png/bdtch, ks3232896-web/endyyee, uchianawitachizon-prog, cybercodex34-glitch, nobitaxnobi00-dotcom, ankit2560777-gif, sanishaw308-sudo, DeactiveCpp4u, malikchikku11-web and t2118417-max. Victims reached these through a WhatsApp link sent during the fake bank call. The detection logic is an exact-match sweep of DNS and proxy logs for the listed domains, and a proxy search for github.com, raw.githubusercontent.com or objects.githubusercontent.com URLs whose path contains any of the listed account names.
Use DNS resolver logs, secure web gateway or mobile-threat-defense web logs, and, for banks and telecoms, the abuse-report and brand-monitoring feeds that see the same domains. Pull the full domain list from the article rather than relying on this sample. Sweep back to January 2025, when Group-IB says the activity began. Scope is every managed phone and any desktop that could have opened the link, with priority on staff of the impersonated banks. Blocking the exact domains is reasonable; blocking github.com, githubusercontent.com or github.io is the wrong control because developers depend on them, and Group-IB had the accounts taken down, so new names will replace them. A hit on a phone should be handled as a possible infection: check installed apps for unknown packages with SMS permissions and treat card and net-banking details used on that phone as exposed. The domain naming pattern (cancel, deactivate, protection, manage combined with a bank abbreviation on .in or .online) generalizes to later waves.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Initial Access → T1566.002 (Phishing: Spearphishing Link); Resource Development → T1608.001 (Stage Capabilities: Upload Malware), T1583.001 (Acquire Infrastructure: Domains)
Sources: “False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps”, Group-IB, Oct. 28, 2026, https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/ (source article)
C2 and Mining Infrastructure Sweep
Group-IB lists the panels and miner infrastructure behind the families: 64.89.163[.]3 (the cyb3rx controller’s hardcoded api_base_url, for example hXXp://64.89.163[.]3/idfc/1/api/ and /pnb/1/api/, and a WebSocket at ws://64.89[.]163.3:8082), 64.89.163[.]4, 78.159.156[.]74, 144.31.244[.]184 and 46.151.182[.]28; the d-miner domains fud2026[.]com, accessor[.]fud2026.com, aptabase[.]fud2026.xyz:8443, pool.fud2026[.]com:9000 and pool-proxy.fud2026[.]com:9000; and fake-update hosts install-update[.]xyz, app2-update2[.]site and update-app[.]online. The detection logic is an exact-match sweep of firewall, NetFlow, DNS and proxy logs for those IPs and hostnames, with extra weight on connections to port 8082 (WebSocket), 8443 or 9000 (mining pool), and on any Android device whose traffic reaches a pool on 9000 while the screen is locked.
Use firewall or NetFlow for the IPs, DNS logs for the hostnames, proxy logs for the URL paths, and mobile network or mobile-threat-defense telemetry for phones on corporate Wi-Fi or VPN. Sweep back to January 2025. Blocking these exact IPs and hostnames is a sound control; blocking the hosting providers’ wider ranges is not, given legitimate use. Group-IB notes d-miner persists with wake locks, a silent audio loop and a foreground service, so a phone that hits the pool will keep doing so until the app is removed. Any hit from a managed device is an infection: isolate the phone from corporate resources, remove the app or wipe the device, and treat SMS-delivered OTPs on it as compromised. Group-IB links d-miner to mining-dropper activity other vendors have reported, so the pool hostnames are worth keeping on watch beyond this campaign.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols); Impact → T1496 (Resource Hijacking)
Sources: “False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps”, Group-IB, Oct. 28, 2026, https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/ (source article)
Panel Endpoint Path Patterns
Several families report to PHP panels whose paths Group-IB documents. appkjl exfiltrates SMS with a form-encoded POST /api/add_sms.php carrying device_id and an sms JSON field. d-shine posts to /message.php with msg, mobNo and phone parameters, from a Dalvik user agent for Android 13. The cyb3rx controller uses an api_base_url of the form /<bank>/1/api/ (for example /idfc/1/api/ and /pnb/1/api/) with update-config.php, delete_device.php, get_device_data.php (data_type values pm_kisan_details, idfc_banking_flow, SMS and Notification) and send_command_to_device.php, and its commands include call_forward_activate, set_sms_forwarding and custom_ussd. The detection logic is a proxy or mobile web-log rule for POST requests to /api/add_sms.php with a device_id parameter, POST /message.php with mobNo, and any path matching /[a-z]+/1/api/(update-config|delete_device|get_device_data|send_command_to_device)\.php, raised when the user agent is Dalvik or Android and the host is an IP literal or a domain first seen in the last 30 days.
Use proxy, secure web gateway or mobile-threat-defense web logs that record the full path and user agent; DNS logs will not see these. Back-test 90 days to measure noise before alerting, then run continuously. Allowlist known SMS-gateway or marketing vendors by hostname if they use similar paths, never by path alone. The panels may move to new IPs, which is why this lead keys on paths and parameters rather than addresses; it will miss families that use Firebase or Telegram only (godz, d-passive, GhostBat, tenxen), which the Elite lead covers. Any confirmed hit should be escalated as a device compromise with likely OTP interception, and for banks, as a customer account to watch for card and net-banking fraud.
Hunt Lead Level: 2 (Pro)
ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (on-device SMS interception and call forwarding are not mapped: the Enterprise matrix has no technique for them)
Sources: “False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps”, Group-IB, Oct. 28, 2026, https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/ (source article)
APK Download Off a Bank-Themed Page
The delivery step is consistent across families: a bank-themed phishing page with a call-to-action button (“Login Now”, “Apply Now”, “Activate Protection”) that silently downloads an APK hosted on GitHub, followed by a fake Google Play update screen while a different app installs, and a prompt to disable battery optimization. The behavioral anchor is an Android device downloading a file with an .apk extension or the application/vnd.android.package-archive content type from github.com, githubusercontent.com or a github.io host, with an HTTP referrer that is a recently registered or first-seen domain containing words such as cancel, deactivate, protect, protection, care, manage, service or policy. The detection logic is a proxy rule on that combination, plus a mobile-device-management or mobile-threat-defense alert for any app installed from an unknown source within a few minutes of that download.
Use secure web gateway or mobile-threat-defense web logs for the download and referrer, and MDM or MTD inventory for the install source. Sweep 90 days, then alert continuously. Scope to phones and tablets, and exclude developer and QA devices by device group, since those legitimately sideload APKs from GitHub. Blocking APK downloads from GitHub on managed phones is a reasonable control for non-developer staff; blocking GitHub outright is not. Hash blocking will not keep up, because Group-IB lists more than 30 distinct APK hashes across the families. A hit with an install should be treated as an infection, and the user’s bank and card details as exposed. The logic generalizes to most Android banking-trojan campaigns that sideload from code-hosting or file-sharing sites.
Hunt Lead Level: 2 (Pro)
ATT&CK: Execution → T1204.002 (User Execution: Malicious File)
Sources: “False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps”, Group-IB, Oct. 28, 2026, https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/ (source article)
Sideloaded SMS-Reading App Talking to Telegram or Firebase
Four of the seven families never touch a PHP panel: godz checks in to Firebase and sends stolen SMS to Telegram, d-passive and tenxen use Firebase for check-in, exfiltration and commands (tenxen’s include checkCallForwarding, enableCallForwarding and forwardSms; d-passive’s include ping and start_core_service), and GhostBat uses Telegram and Firebase with commands such as callForward, smsForward and KeyLogger. cyb3rx also checks in over Telegram. The detection therefore has to combine device state with network behavior: an app installed outside Google Play that holds SMS read/send or phone permissions (or Accessibility), on a device that then makes traffic to Telegram’s bot API or to a Firebase Realtime Database or Firestore project that does not belong to any approved app, followed by SMS-forwarding or call-forwarding activity. The detection logic is a correlation keyed on device ID: MDM or MTD inventory showing the sideloaded app and its permissions, joined to network logs for api.telegram[.]org or *.firebaseio[.]com traffic from that device within 24 hours of the install, with severity raised if the carrier or MDM reports call forwarding enabled.
This needs MDM or mobile-threat-defense inventory (install source, permissions), network telemetry for phones (corporate Wi-Fi, VPN or MTD network logs), and, for banks and telecoms, call-forwarding and SIM-change data. Build the allowlist of approved apps and their Firebase project names first and maintain it; allowlist by package name plus signing certificate, not by app label, since the trojans use bank-like names and fake Google Play screens. Run continuously and back-test 90 days. Banks can run a parallel version on the fraud side: a customer whose card was issued in the last 24 hours, whose verification call goes unanswered or diverted, and whose net-banking session then comes from a new device, matches the sequence Group-IB describes. Any correlated hit is an infection: remove or wipe, reset banking credentials from a clean device, and contact the bank to freeze cards. The correlation generalizes to other Telegram- and Firebase-controlled Android trojans.
Hunt Lead Level: 3 (Elite)
ATT&CK: Command and Control → T1102 (Web Service) (Telegram and Firebase as C2 channels; SMS and call-forwarding abuse is not mapped, as the Enterprise matrix has no technique for it)
Sources: “False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps”, Group-IB, Oct. 28, 2026, https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/ (source article)
Hash Appendix
Group-IB publishes SHA-256 values only, all for Android APKs delivered from GitHub during the fake card-protection flow. MD5 and SHA-1 were not published and were not retrieved from AlienVault OTX or VirusTotal for this report; they are marked not available.
cyb3rx (listed by Group-IB as “cyberx”)
MD5s
(not available) # all 21 cyb3rx APKs below
SHA1s
(not available) # all 21 cyb3rx APKs below
SHA256s
0ad853b29a7b3677488018061b109bba59b1a518c8f33b48de31ec532be69856 # cyb3rx APK, sideloaded from GitHub
1e60421e83a317cfbfce980fefa926a847964bcc7b047908db65161148d0f624 # cyb3rx APK, sideloaded from GitHub
2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f # cyb3rx APK, sideloaded from GitHub
3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921 # cyb3rx APK, sideloaded from GitHub
5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4 # cyb3rx APK, sideloaded from GitHub
5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456 # cyb3rx APK, sideloaded from GitHub
7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d # cyb3rx APK, sideloaded from GitHub
47ae095fd9e5143798a70805a23eb294fc072170dac19c1fa112beca186d844a # cyb3rx APK, sideloaded from GitHub
65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68 # cyb3rx APK, sideloaded from GitHub
80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a # cyb3rx APK, sideloaded from GitHub
431ae9a0569c52de8fb5abffcf12919b8d685a879f4e777602ae490dbc2a6baa # cyb3rx APK, sideloaded from GitHub
902803b40aa30d12e60a37680b113d5fc7c79695b7e1b72904fa7de06cf9b27b # cyb3rx APK, sideloaded from GitHub
b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9 # cyb3rx APK, sideloaded from GitHub
b332fa9c08020fbbc5503091b4f4a61ee66a05a0a76abf9a53db9f3d80c4862a # cyb3rx APK, sideloaded from GitHub
c9ead89d1bcb09923e1057bb4617726867154d36932ed1c2f82c2466bf11934c # cyb3rx APK, sideloaded from GitHub
c36d2b4480034a409f33cdef8d7c3501e75f14d2c5bd9a914a65fd7f3c47d74a # cyb3rx APK, sideloaded from GitHub
c6708166e0a6bf3484200fd6dd1569d89e81c36ffd76ff2ab5820b06fd2d5b54 # cyb3rx APK, sideloaded from GitHub
cb86017411708eb6e5384fc0288b0ec4692ea45ef38586b7c67f99148e1117c3 # cyb3rx APK, sideloaded from GitHub
cf32addd82960501859f205b0fca8c0b51a40857f71e4a2aee8d70b2433319b7 # cyb3rx APK, sideloaded from GitHub
cf66a1acebd878d85345377be53ac0b241f517253811ec969c8ff9c751151424 # cyb3rx APK, sideloaded from GitHub
dfa02773f97f552deb7ff04f5c598a81be4d236fe33adca2a47551485a3aeb2a # cyb3rx APK, sideloaded from GitHub
godz
MD5s
(not available) # all 4 godz APKs below
SHA1s
(not available) # all 4 godz APKs below
SHA256s
9e7cdafcb473d28e134f87d758839265e97b03cf260a186d0e21e1de8aeb7fa8 # godz APK (Firebase check-in, Telegram exfiltration)
1b9052d85e12573b4f64f6a47f64803007b19990def1bc62a865de00149a825e # godz APK
5c0f8bca492c9ee79d6bbd7a532945514670321a605002987f69e3331110e447 # godz APK
53f9fcf3a6fdc59e9a28fd129a32064d78628289eac72d47f53d63cbc434de41 # godz APK
GhostBat
MD5s
(not available) # both GhostBat APKs below
SHA1s
(not available) # both GhostBat APKs below
SHA256s
43b217184f7765c699fd887fe22c07c7656483dc088e0214587a4890b2b6aee6 # GhostBat APK (Telegram + Firebase)
34b75b78b6c575c8a9e71f712be9d90aa35a3a04b48839f86282678107f7876d # GhostBat APK
d-passive
MD5s
(not available) # both d-passive APKs below
SHA1s
(not available) # both d-passive APKs below
SHA256s
1bfaaa9aed67552a2c368df3f264ef6878a4e7b43468546db77f095517b15b56 # d-passive.ExampleAdmin APK
04b35b0c199ef8a13d6ac18dfc6df2ea66a8ed5b6e464dc3a7db0839093882bd # d-passive.TradeSignals APK
tenxen
MD5s
(not available) # both tenxen APKs below
SHA1s
(not available) # both tenxen APKs below
SHA256s
d72335c0cbbcef002274c1a5087702ed4a91d91a79279104aaf111a33984ae5f # tenxen APK (Firebase C2, call/SMS forwarding)
4a17171155997754ad735b460be67e344c5939d9cff498ce1d95bf554b93fc1b # tenxen APK
d-shine
MD5s
(not available) # d-shine APK below
SHA1s
(not available) # d-shine APK below
SHA256s
3b6c2dcba751d1ea05b83fd609e13423dff575705920a1c835ff0d5f92403ffc # d-shine APK (POST /message.php)
appkjl
MD5s
(not available) # appkjl APK below
SHA1s
(not available) # appkjl APK below
SHA256s
555e0506979e0b26e4318c0f7dfff0e3dc5c81bb7e3925f2cadd1bdeb843570f # appkjl APK (POST /api/add_sms.php)
References Appendix
- “False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking Apps”, Group-IB (Mahima; Ngo Thanh Van), Oct. 28, 2026, https://www.group-ib.com/blog/cyberdakait-seven-android-trojans-indian-banking/ (source article; lure flow, family C2 details, IOCs, hashes)
- “GhostGrab Android Malware”, CYFIRMA, Oct. 25, 2025, https://www.cyfirma.com/research/ghostgrab-android-malware/ (GhostGrab alias reconciliation, as cited by Group-IB)
- MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/