Inside the RTO-Challan Dropper: Anatomy of a Two-Stage Android Bank Stealer

In December 2025, CYFIRMA published a technical report on an "RTO Challan" Android app that is a near-textbook example of how a two-stage dropper turns a clean-looking download into a hidden credential harvester. It's the same social-engineering wrapper as every other fake-challan scam in India, but the implementation is careful enough to be worth taking apart.

This is a walk through how it installs, what it steals, and how it stays hidden, based on CYFIRMA's analysis. IOCs are at the end.

At a glance

• Masquerades as: an "E-Challan" / "RTO Challan" traffic-fine app
• Delivery: WhatsApp messages with fake challan numbers and vehicle details
• Structure: a two-stage dropper — the first app installs a second, hidden one
• Steals: Aadhaar, PAN, DOB; full card data, ATM PIN, net-banking creds, UPI PIN; all incoming SMS/OTPs
• C2: HTTP POST to jsonserv[.]xyz and jsonserv[.]biz, with C2 URLs base64-encoded and split into chunks
• Hides via: a launcher activity set to INFO (no app-drawer icon), battery-optimisation exemption, and a custom VPN service

Two stages, one icon

The app the victim installs is a loader. On launch it shows a fake "App Update Available" dialog; tapping Update downloads and installs a second APK with the same name and icon. The first app routes the user through the "install unknown apps" setting, and the second payload installs behind it.

How the two-stage dropper installs and where the data goes

The clever part is what happens next. The second APK's main activity is exported but categorised as INFO instead of LAUNCHER, so it never appears in the app drawer. There is nothing obvious for the victim to find or uninstall, and it runs silently.

The permissions tell the story

The manifest requests exactly what a bank stealer needs and little else:

• READ_SMS, RECEIVE_SMS, SEND_SMS — read and send text messages
• REQUEST_INSTALL_PACKAGES — install the second-stage payload
• BIND_VPN_SERVICE — stand up a custom VPN service
• CALL_PHONE, READ_PHONE_STATE — telephony data and call handling
• REQUEST_IGNORE_BATTERY_OPTIMIZATION — survive in the background

What it collects

The app mimics the legitimate e-Challan app and pulls data at two points:

• Identity, through a fake form: name, mobile number, mother's name, date of birth, Aadhaar, and PAN.
• Payment, through fake payment screens tied to a bogus ₹1 "verification" fee (with a promised refund in 24 hours): card number, expiry, CVV, ATM PIN, net-banking credentials, and UPI PIN.

CYFIRMA notes a telling design choice: the UPI payment always fails, which pushes the victim toward entering card details instead. After card submission the app shows a "successful" status and claims details are "being verified" for 24 hours — a delay that simply buys the operators time to use what they've stolen.

It also enumerates device and SIM data (model, carrier, subscription IDs, other active SIMs) to find a usable number to abuse.

SMS interception and persistence

A broadcast receiver processes incoming SMS at the PDU level — extracting body, timestamp, sender and SIM slot and rebuilding the message before the user or legitimate apps see it. The intercepted texts are forwarded for OTP harvesting, and a separate routine sends attacker-defined SMS through SmsManager with no user interaction, which can spread the phishing link (and the malware) further. CYFIRMA also describes possible USSD use to change call forwarding, diverting verification calls.

Persistence and stealth come from three things working together:

• A battery-optimisation exemption so the app keeps running in the background.
• A custom VPN service that the report says hides C2 traffic and can block or manipulate network traffic.
• The hidden-icon trick above.

C2 and obfuscation

Exfiltration is an HTTP POST to jsonserv[.]xyz and jsonserv[.]biz, which share registrar and name-server characteristics (common control). The C2 URLs are stored base64-encoded and split into chunks to dodge static detection, and there's an action-based endpoint interface (app-manage?action=) for uploads and task polling, plus an app-registration endpoint that tracks infected devices by package name and a generated UUID.

Control-flow is protected with NP ApkControlFlowConfusion, and the manifest carries a malformed tag and a non-standard package name — small touches that trip up naive tooling.

Indicators of compromise

From CYFIRMA's report:

SHA-256 (dropper):  9209fc088cdcd7da0161cabf5b9384c2ca790214413ffb437452bcc865c58452
SHA-256 (payload):  22cf70a0dd866a4f5addd5d339fad3894a4ebb3e97d597fd7dac9b08899052fb
Domains:            jsonserv[.]xyz, jsonserv[.]biz

These and other campaign indicators are in the India Threat Tracker.

Defence

• For users: a government e-Challan app will never be sent to you over WhatsApp, never ask for a "₹1 verification," and never ask for your UPI PIN to receive a refund. Any of those three is the tell. Pay challans only through the official state transport / mParivahan channels you navigate to yourself.
• For defenders: watch for an app requesting REQUEST_INSTALL_PACKAGES and SMS permissions, a newly installed app that immediately binds a VPN service, or an app whose activity is exported as INFO rather than LAUNCHER. Block the C2 domains and alert on the registration pattern.
• For banks: the whole design exists to steal the OTP and the UPI PIN. Everything in the earlier APK fraud writeup about reducing SMS-OTP reliance applies here directly.

The wrapper is crude, but the payload is a complete, stealthy bank stealer. That gap — dumb lure, capable malware — is exactly why these campaigns keep working.

This article reflects public information as of 13 December 2025.

Sources

• CYFIRMA — RTO Challan Fraud: a technical report on APK-based financial and identity theft