India's cybercrime agency has ordered Google to block hundreds of accounts on Firebase, an app development platform, after it was discovered that numerous fake banking apps and phishing sites were linked to this service.
The Indian Cyber Crime Coordination Centre (I4C) sent Google at least three notices in August, listing at least 57 websites and databases operating on Firebase. These notices claimed that the links were being used as tools to distribute malware and extract financial data from victims' devices.
Of these 57 websites and databases, seven were phishing pages modeled after the login screens of major Indian banks, including the State Bank of India, ICICI Bank, and Axis Bank. The rest, according to officials, were collection points for stolen information such as credit card numbers and one-time passwords.
Credit Card Fraud Method
According to an August 17 report, scammers developed Android malware disguised as genuine banking applications and specifically targeted cardholders. Common financial lures were used as bait, including a new credit card, a reward, and an increase in credit limit.
A victim falling for the malware scam installed an app that looked like a banking app. Upon connecting to the phone, the program would stealthily forward data to a Firebase database controlled by the scammers. This gave the scammers access to other applications on the device and, potentially, the victim's money.
The authorities identified one fraud scheme built around the federal PM-KISAN program, which directly pays money to small farmers. Fake sites promised to help recipients receive their money and offered them to download an app to obtain these funds. This app also redirected user data directly to the attackers.
India Takes Action Against Firebase Infrastructure
In India, over 242 billion transactions were processed through the real-time payment system. This massive user base provides scammers with the opportunity to access a huge number of victims within the country.
Firebase is used by millions of developers worldwide because it is quite easily accessible. Criminals have also taken advantage of this, switching to the platform from other free tools over the past year due to its free tier and database capabilities.
The standard response of the Indian government to such fraud schemes had been to simply track the fraudulent websites and block them. However, the new measures indicate a larger-scale approach aimed at the infrastructure supporting these schemes.
