India Orders Alphabet to Takedown 57 Firebase Accounts Used in Massive $2.4 Billion Banking ScamThe Indian government has officially directed Alphabet Inc. to shut down 57 Google Firebase accounts exploited by cybercriminals to orchestrate a $2.4 billion banking fraud scheme. The nationwide crackdown targets malicious applications distributed via Google’s cloud development platform, which impersonated major Indian financial institutions to drain user accounts.
The Indian Cyber Crime Coordination Centre issued an urgent directive ordering the immediate purging of rogue databases and websites hosted on Firebase. Investigators revealed that cybercriminals deliberately migrated to Google’s cloud infrastructure to build convincing clones of top-tier banks, including State Bank of India (SBI), ICICI Bank Ltd., and Axis Bank Ltd.
Cybersecurity researchers warned that once installed, these trojanized banking apps granted attackers near-total remote control over victims' devices intercepting two-factor authentication (2FA) SMS codes and executing unauthorized wire transfers. The scale of the breach highlights critical security vulnerabilities across India's booming digital economy, which processed over 242 billion electronic transactions in the fiscal year ending March.
Alphabet responded by reiterating its strict policies against platform abuse, confirming full cooperation with Indian law enforcement. India’s cybercrime agency will conduct a compliance audit on August 28 to ensure all malicious infrastructure has been dismantled.
The concept of "Living Off the Land" (LotL) in modern malware design involves hosting malicious backends, database listeners, and command and control (C2) servers on Google Firebase. This allows hackers to bypass traditional antivirus programs and firewall rules, as enterprise security systems trust traffic originating from the official *.firebaseio.com domain. Malicious apps can then steal banking credentials without triggering network alarms.
India's Unified Payment Interface (UPI) and digital banking networks have driven unprecedented access to financial services, with over 242 billion transactions annually. However, this rapid digital adoption creates a large target for social attacks. Cybercriminals exploit less tech-savvy users by sending phishing SMS messages offering "loyalty points" or "account updates," tricking users into downloading fake APK files from external sources other than official app stores.
This forces technology platforms and regulators to reconsider their policies on installing apps from external sources on mobile operating systems. Going forward, governments are pressuring mobile operating system providers to implement stricter authentication for SMS interception and hardware-level restrictions that block unverified third-party financial applications from accessing support services on consumer devices.
India Orders Alphabet to Takedown 57 Firebase Accounts Used in Massive $2.4 Billion Banking ScamThe Indian government has officially directed Alphabet Inc. to shut down 57 Google Firebase accounts exploited by cybercriminals to orchestrate a $2.4 billion banking fraud scheme. The nationwide crackdown targets malicious applications distributed via Google’s cloud development platform, which impersonated major Indian financial institutions to drain user accounts.
The Indian Cyber Crime Coordination Centre issued an urgent directive ordering the immediate purging of rogue databases and websites hosted on Firebase. Investigators revealed that cybercriminals deliberately migrated to Google’s cloud infrastructure to build convincing clones of top-tier banks, including State Bank of India (SBI), ICICI Bank Ltd., and Axis Bank Ltd.
Cybersecurity researchers warned that once installed, these trojanized banking apps granted attackers near-total remote control over victims' devices intercepting two-factor authentication (2FA) SMS codes and executing unauthorized wire transfers. The scale of the breach highlights critical security vulnerabilities across India's booming digital economy, which processed over 242 billion electronic transactions in the fiscal year ending March.
Alphabet responded by reiterating its strict policies against platform abuse, confirming full cooperation with Indian law enforcement. India’s cybercrime agency will conduct a compliance audit on August 28 to ensure all malicious infrastructure has been dismantled.
The concept of "Living Off the Land" (LotL) in modern malware design involves hosting malicious backends, database listeners, and command and control (C2) servers on Google Firebase. This allows hackers to bypass traditional antivirus programs and firewall rules, as enterprise security systems trust traffic originating from the official *.firebaseio.com domain. Malicious apps can then steal banking credentials without triggering network alarms.
India's Unified Payment Interface (UPI) and digital banking networks have driven unprecedented access to financial services, with over 242 billion transactions annually. However, this rapid digital adoption creates a large target for social attacks. Cybercriminals exploit less tech-savvy users by sending phishing SMS messages offering "loyalty points" or "account updates," tricking users into downloading fake APK files from external sources other than official app stores.
This forces technology platforms and regulators to reconsider their policies on installing apps from external sources on mobile operating systems. Going forward, governments are pressuring mobile operating system providers to implement stricter authentication for SMS interception and hardware-level restrictions that block unverified third-party financial applications from accessing support services on consumer devices.
Comments
Post a Comment