From stolen OTPs to remote control: how Android banking fraud in Indonesia changed

Many WhatsApp users in Indonesia will remember the wedding invitation that wasn't. In early 2023, messages carrying a file called "Surat Undangan Pernikahan" spread widely. It was an Android APK. Installing it meant accepting warnings about unknown sources and granting access to SMS, and its purpose was to intercept the one-time passwords that mobile banking sends by text.¹

Even then, a security expert quoted at the time pointed out a limit: an SMS OTP on its own wasn't enough. The attacker still needed the victim's user ID, password or PIN, obtained some other way.¹ The attack stole one factor and relied on finding the others.

Three years later, the attacker doesn't need the code

The volume has grown. Kaspersky counted a 56% rise in attacks by banking trojans on Android smartphones in 2025, and 255,090 new malicious installation packages, up 271% on the year before. It names messaging apps and malicious web pages as common ways they spread.²

The capability has changed more than the volume. The Gigabud campaign that Group-IB documented in September 2026 doesn't need to read a code and replay it elsewhere. It asks for Accessibility access, captures the lock-screen code with invisible overlays, clones the banking app into a hidden work profile, and lets an operator tap and type on the victim's phone in real time, behind a black screen.³ The transfer comes from the customer's own device. Any OTP arrives on that same device, where an operator with live control of the screen can read it.

What this means for step-up

SMS OTP answers the question "does this person have the customer's phone?" Once the attacker is operating that phone, the answer is always yes. Adding more OTP prompts doesn't change it; it adds cost and teaches customers to tap through.

The better question at the moment of a transfer is whether this device and this session can be trusted right now. That means looking at things an OTP can't see:

• whether an unrecognised app holds Accessibility or overlay access,
• whether the banking app is a fresh or cloned installation rather than the device you bound months ago,
• whether the rhythm of the session looks like a person or an operator, and
• whether the device, account or recipient has shown up in other fraud.

Used this way, OTP becomes one of several step-up options, triggered selectively when the device or session looks wrong, rather than the default answer to every transfer.