Shobhit Mishra

CloudSEK’s latest report highlights a major shift in mobile financial fraud, where threat actors use the LSPosed framework to manipulate Android at runtime and bypass UPI SIM-binding security without altering legitimate payment apps. The technique enables remote SMS injection, identity spoofing, OTP interception, and real-time account takeover at scale. The report urges banks to adopt stronger device integrity checks and carrier-side validation to counter this evolving threat.

CloudSEK has uncovered a malicious SMS spoofing campaign spreading a fake version of Israel’s “Red Alert” emergency app amid the ongoing conflict. Disguised as a trusted warning platform, the trojanized Android app can steal SMS, contacts, and location data while appearing legitimate. The report highlights how cybercriminals are weaponising public fear during crises to deploy mobile spyware with serious security and real-world implications.