Indian banks including ICICI, SBI, Axis impersonated by Android malware using Firebase, government blocking notices show

NEW DELHI, Aug 23 - Android malware masquerading as ICICI Bank, Axis Bank, State Bank of India and other lenders' credit-card services and using Google's Firebase as its backend has prompted a sweeping takedown drive by India's Home Ministry cybercrime agency, blocking orders reviewed from Lumen DB show.

The Indian Cybercrime Coordination Centre (I4C), the nodal agency under the Ministry of Home Affairs for cyber fraud, has ordered Google to disable more than 160 Firebase projects in recent months that were harvesting SMS one-time passwords and credit card data, the documents show. I4C's National Cybercrime Threat Analysis Unit (I4C-NCTAU) dismantled the backend Realtime Database where SMS OTPs and credit-card data were being exfiltrated.

Of 167 URLs reviewed, over 70% directly impersonate banks or financial services, while a parallel cluster impersonates PM-Kisan Yojana to steal bank account details linked to government transfers.

APK files targeting credit card customers

Android-based malwares (APKs) were masquerading as legitimate banking services, specifically targeting Android users with credit cards. Scammers lure victims by promoting offers such as new credit cards, reward redemptions, or credit limit upgrades.

The malware is engineered to exfiltrate SMS data from infected devices to the Firebase domain while also collecting sensitive personal and financial information, including credit card details.

Sahyog portal intimations to Google reviewed by researchers from Ministry of Cyber Affairs shows.

• Firebase Hosting phishing fronts - iciciusercard.web.app - ICICI Bank, openaxiscredit.web.app / axisupdates.web.app - Axis Bank, aucreditcard.web.app / aubanklogin.web.app - AU Small Finance Bank, mysbicard.web.app - SBI Card, cardhelpnow.web.app - generic credit-card help lure.
• Firebase Realtime Database exfiltration backends - hsbc-crdit-card-default-rtdb.asia-southeast1.firebasedatabase.app - HSBC credit card, boi-51-default-rtdb - Bank of India, bob-1-a0e9b-default-rtdb - Bank of Baroda, csb-bank-2-default-rtdb, union-25-default-rtdb, sbi-18-default-rtdb through sbi-72-default-rtdb, sbi-30, sbi-33-be074, sbi-45, sbi-58-a9f33, sbi-61-d2836, sbi-63-67190, sbi-pvt-4, sbii-37, sbidemo-b7a6b, mgl-5-bef1f to mgl-17, igl-3-da175, bill-13 to bill-36, meter-3, meter-7-c2372, gas-bill-update-2, gas-cylinder-book-1.

The PM-Kisan parallel - targeting farmers

A second major cluster uses PM-Kisan Yojana, India's farmer income support scheme that credits directly to bank accounts:

pm-kisan-01hfg-default-rtdb, pm-kisan-03-9c8f7-default-rtdb, pm-kisan-13bguh-default-rtdb, pm-kisan-25hxg-default-rtdb, pm-kisan-28hhj-default-rtdb, pm-kisan-30jgi-default-rtdb, pm-kishan-24hguh-default-rtdb, pm-kishan-31-ea1ac-default-rtdb, pm-kishan-a8-default-rtdb, pm-modi-22dh-default-rtdb, pm75-a64de-default-rtdb, pmkishn2-default-rtdb, pmudhay-4b728-default-rtdb, plus karishmacsc-42128-default-rtdb [CSC centre] and kitter-rajk8.

Farmers are told their PM-Kisan instalment is blocked and asked to install an APK to "verify bank account" - which then steals the account linked to Direct Benefit Transfer.

How it was blocked: Sahyog portal and 79(3)(b) of IT Act

Unlike traditional court-led blocking, India's approach pairs speed with due process. The Sahyog portal brings all authorized agencies and all intermediaries under one platform to ensure immediate action, while requiring a reasoned intimation in writing that preserves evidence for investigation. The three-hour removal window under Rule 3(1)(d) forces intermediaries like Google to act fast, but because the notice is targeted at a specific Firebase project URL - *.firebaseio.com or *.web.app - rather than a whole domain, it avoids collateral over-blocking of legitimate developers.

Google was asked to remove access "without vitiating the evidence." Researchers from MoCA Team have found that all the domains have been successfully taken down by Google.

Why Firebase works for bank malware

What is Firebase? Google's app platform gives any developer a free backend. Realtime Database provides an HTTPS endpoint like https://paisa-8e4f4-default-rtdb.firebaseio.com for JSON exfiltration, while Hosting gives *.web.app phishing pages with valid Google TLS certificates.

Banking-specific tradecraft observed:

1. Typosquat + trust: hsbc-crdit-card, coustmer-support-1, coustomer-17, hospitl-1, iciciusercard - minor misspellings that pass visual checks but live on trusted web.app / firebaseio.com domains.
2. Personalized infrastructure: The July 15 notice - ajay-705f2-default-rtdb, cust-3-882d8, customer-13-fc56a, devil4-b1ab7, raht566-ec24b, su2n-2, web12-91eeb - and the June 09 31-URL notice - aaaa-b3749, ck-kumar3, lalanashish2, parkashbhai, radhe-d31aa, rahul-6bf55 - use Indian first names plus 4-5 hex chars. This indicates per-affiliate Firebase projects to silo stolen bank OTPs and avoid single-point detection. Lumen redacts them as f[redacted]o.com.
3. Regional targeting: Almost all bank-bill and RTO lures in the 82-URL June 09 PDF - bill-13-default-rtdb.asia-southeast1, rto-105-a1918, rto-112-18202, sbi-18 - use asia-southeast1.firebasedatabase.app, Google's Singapore region, chosen for low latency to Indian banks for real-time OTP interception.

For all the scale of the fraud - 160-plus disposable projects in three months - officials and researchers say the operation offers a template other governments grappling with similar abuse of trusted cloud platforms are now studying.

For other governments, the lesson, officials note, is not to build a new law, but a single-window workflow: a time-bound, evidence-preserving, platform-agnostic takedown mechanism that treats Firebase, Cloudflare or any other trusted infrastructure the same way - as an intermediary resource that can be misused, and quickly cleaned, without breaking the internet for everyone else.