indicator,type,campaign_id,campaign,confidence,source,source_url,source_checked,status
jsonserv[.]xyz,domains,sm-2025-002,RTO Challan fraud - two-stage dropper (jsonserv C2),high,CYFIRMA - RTO Challan Fraud: a technical report on APK-based financial and identity theft,https://www.cyfirma.com/research/rto-challan-fraud-a-technical-report-on-apk-based-financial-and-identity-theft/,2026-10-20,as reported; not re-validated; last seen not tracked
jsonserv[.]biz,domains,sm-2025-002,RTO Challan fraud - two-stage dropper (jsonserv C2),high,CYFIRMA - RTO Challan Fraud: a technical report on APK-based financial and identity theft,https://www.cyfirma.com/research/rto-challan-fraud-a-technical-report-on-apk-based-financial-and-identity-theft/,2026-10-20,as reported; not re-validated; last seen not tracked
9209fc088cdcd7da0161cabf5b9384c2ca790214413ffb437452bcc865c58452,sha256,sm-2025-002,RTO Challan fraud - two-stage dropper (jsonserv C2),high,CYFIRMA - RTO Challan Fraud: a technical report on APK-based financial and identity theft,https://www.cyfirma.com/research/rto-challan-fraud-a-technical-report-on-apk-based-financial-and-identity-theft/,2026-10-20,as reported; not re-validated; last seen not tracked
22cf70a0dd866a4f5addd5d339fad3894a4ebb3e97d597fd7dac9b08899052fb,sha256,sm-2025-002,RTO Challan fraud - two-stage dropper (jsonserv C2),high,CYFIRMA - RTO Challan Fraud: a technical report on APK-based financial and identity theft,https://www.cyfirma.com/research/rto-challan-fraud-a-technical-report-on-apk-based-financial-and-identity-theft/,2026-10-20,as reported; not re-validated; last seen not tracked
27051a225ea950c7d62ddbac6c7c4754bf86be94fddf0d3c10e2827d6eedffd5,sha256,sm-2025-003,Android banking trojan - MITM + anti-analysis (case study),high,sohankanna.com - Deconstructing a Stealthy Android Trojan,https://www.sohankanna.com/research/deconstructing-a-stealthy-android-trojan-a-case-study-in-phishing-and-evasion,2026-10-20,as reported; not re-validated; last seen not tracked
com.iudxmm.android,package_names,sm-2025-003,Android banking trojan - MITM + anti-analysis (case study),high,sohankanna.com - Deconstructing a Stealthy Android Trojan,https://www.sohankanna.com/research/deconstructing-a-stealthy-android-trojan-a-case-study-in-phishing-and-evasion,2026-10-20,as reported; not re-validated; last seen not tracked
GhostBatRat_bot,telegram_bots,sm-2025-001,GhostBat RAT - RTO/mParivahan-themed Android campaign,high,Cyble - GhostBat RAT: inside the resurgence of RTO-themed Android malware,https://cyble.com/blog/ghostbat-rat-inside-the-resurgence-of-rto-themed-android-malware/,2026-10-20,as reported; not re-validated; last seen not tracked