NexusRoute

NexusRoute is a newly discovered Android remote access trojan (RAT) and malware campaign targeting Indian users. It is distributed through phishing portals and fake applications that impersonate Indian government services, particularly mParivahan and e-Challan, with malicious APKs hosted via GitHub, including hundreds of fake repositories. The malware is used for credential theft, UPI fraud, financial theft, and device surveillance.

High-confidence reported capabilities include theft of mobile numbers, vehicle data, login credentials, bank account details, card details, UPI PINs, and SMS one-time passwords. It also supports broader surveillance and remote access functions, including GPS tracking, microphone activation, and remote screen capture. The malware requests high-risk Android permissions such as SMS access, accessibility services, overlay permissions, and full file access.

Technically, the initial APK acts as a dropper. It loads a native library named "npdcc" via JNI and uses DexClassLoader to dynamically load additional malicious packages from external storage. For persistence and evasion, it abuses BroadcastReceiver, foreground services, and OEM-specific auto-start mechanisms. It also uses fake security notifications resembling Google Play updates to trick victims into granting permissions; once accessibility access is granted, it can auto-approve remaining permissions. A fake uninstall flow reportedly removes only the dropper while leaving the main payload active and hidden.

Exfiltrated data is sent to command-and-control infrastructure via Socket.IO. The campaign has been linked to a broader underground or commercial Android obfuscation and surveillance ecosystem, including reporting that associates it with the email gymkhana.studio@gmail[.]com and developer communities focused on Android obfuscation and app modification. Reporting describes the infrastructure as professionally maintained and indicative of a large-scale, organized fraud and surveillance operation. NexusRoute has been analyzed by CYFIRMA and referenced alongside other active Android malware families observed in the wild.