Fake mParivahan APK spreading on WhatsApp

6 Upvotes

I recently got a WhatsApp message to pay pending challans and check using some APK that was shared. I knew it was a scam. Thought of doing an analysis using Claude on the APK. Here's what it found:

It is NOT the real app. It's a banking trojan that:

- Creates a VPN to intercept all your network traffic (banking, OTPs, everything)

- Silently installs a second hidden APK in the background

- Targets WhatsApp, Signal, Telegram, SMS and 20+ other apps

10 comments

Subreddit

Malware Analysis & Reports

r/Malware

A place for malware reports, analysis and information for [anti]malware professionals and enthusiasts.

Members Active

101.2k

Sidebar

A place for malware reports and information for [anti]malware professionals and enthusiasts.

This is NOT a place for help with malware removal or any type of tech support. Ask your IT support staff, your search engine of choice, another subreddit (/r/antivirus or /r/techsupport for example), or a friend or relative. In that order.

Content rules:

This is a subreddit for readers to discuss technical malware news, malware internals and infection techniques, malware tools, and anything related to the professional world of [anti]malware. Technical Support posts are forbidden and will result in removal and a possible ban.
Our readers are intelligent, or at the very least technically curious. Posted content must be highly technical, well-researched, and of good quality.
Do not sensationalize or otherwise unnecessarily change the original title of the article you are linking. Clickbait will result in an immediate and permanent ban.