The Challenge
A bank approached Tinycrows after customers reported unauthorized UPI transactions. Victims stated that they had neither registered for the UPI applications involved nor initiated the disputed payments.
The attack began with a malicious Android APK disguised as a wedding invitation and distributed through WhatsApp. Believing it to be a genuine invitation, victims installed the application, unknowingly exposing their devices to potential compromise.
The incident demonstrated how social engineering and device compromise could be combined to facilitate unauthorized UPI registration and fraudulent transactions.
Initial Compromise: Victims installed the fake wedding invitation APK, giving the attacker an opportunity to gain unauthorized access to their devices.
Unauthorized UPI Registration: The attacker initiated registration on a UPI application that the victim had never used.
OTP Interception: The registration OTP arrived on the victim’s own phone. By leveraging access to the compromised device, the attacker could obtain the OTP and complete the verification process.
Security Control Bypass: The attack involved circumventing secure-screen protections, enabling the attacker to observe sensitive screens and interact with the UPI application.
Fraudulent Transactions: After completing registration, the attacker initiated unauthorized payments. Victims later discovered the transactions and reported them to their bank.
Tinycrows worked directly with the bank to replicate the reported attack scenario in a controlled assessment environment and understand how the attack chain operated.
The team examined the process from end to end, including malicious APK installation, device-level access, OTP interception, unauthorized UPI registration, and the circumvention of mobile security controls. This approach helped demonstrate how a compromised device could be exploited to perform transactions without the customer's knowledge or consent.
By reproducing the attack, Tinycrows provided the bank with practical insight into the techniques involved, the security weaknesses that could enable the fraud, and the areas requiring remediation.
Tinycrows successfully replicated the attack scenario and helped the bank understand the underlying security gaps and address the issue.
The assessment supported remediation efforts focused on:
- Strengthening Android malware and device-compromise detection.
- Improving OTP security and UPI registration verification.
- Enhancing protection against screen capture, overlays, and unauthorized application interaction.
- Strengthening device binding and transaction authorization controls.
- Improving fraud monitoring for suspicious registrations and payment activity.
A secure banking application depends not only on its own security controls but also on the integrity of the device and the registration process.
This engagement demonstrated how a seemingly harmless wedding invitation could become the entry point for a sophisticated UPI fraud scenario. By replicating the attack and helping the bank understand and address the underlying weaknesses, Tinycrows contributed to strengthening its security posture and protecting customers against similar threats.
.png)
