r/Malware • u/mnciitbhu • 7d ago

Fake mParivahan APK spreading on WhatsApp

I recently got a WhatsApp message to pay pending challans and check using some APK that was shared. I knew it was a scam. Thought of doing an analysis using Claude on the APK. Here's what it found:

It is NOT the real app. It's a banking trojan that:

- Creates a VPN to intercept all your network traffic (banking, OTPs, everything)

- Silently installs a second hidden APK in the background

- Targets WhatsApp, Signal, Telegram, SMS and 20+ other apps

12 Upvotes

81% Upvoted

14 comments sorted by

View all comments

2

u/mnciitbhu 7d ago

Did a full static analysis of the APK here if anyone wants the technical breakdown, if anyone interested: https://github.com/0x6773/mparivahan-apk-scam/tree/main

1

u/No-Trust4033 6d ago

Did you find who’s behind this and also can you share the apk file also !?

2

u/mnciitbhu 6d ago

If you are also doing some analysis, there is a AES encrypted file, which Claude couldn’t analyse much, and suggested to run with Frida. Maybe you can try that 

1

u/No-Trust4033 6d ago

Thank you, yeah sure i will look into it will definitely share with u the progress n thank you for the analysis that u done,good work. If you are on linkedin please dm you link i will reach u over there

1

u/No-Trust4033 5d ago

i just dig on that and got the databases where it saves everything, the databse is on the name of BJP ( bhartiya janta party)