India’s Computer Emergency Response Team issued a fresh alert naming spoof FASTag recharge portals that trick drivers into installing an Android banking trojan linked to the Anubis malware family, a scam wave that peaks when festival travel puts more cars on national highways.
How the lure works
Smishing messages claim a toll wallet balance is low and link to look-alike sites that mimic NHAI-affiliated payment flows. Victims who download the suggested “update” APK grant accessibility permissions that let attackers record banking credentials and one-time passwords. Aditya Banerjee’s security desk has seen parallel campaigns spoofing courier refunds; the FASTag variant targets commuters who top up wallets from phones while queued at plazas.
Who is exposed
Android users who sideload apps outside the Play Store face the highest risk. Fleet operators managing dozens of tags on commercial vehicles are attractive targets because a single compromised phone may be tied to corporate accounts. CERT-In’s bulletin urges enterprises to block unknown APK installs through mobile device management and to train drivers not to click SMS links purporting to be from banks or toll operators.
Defensive steps
Legitimate FASTag balances can be checked through issuer apps from banks or payment apps such as Paytm and PhonePe, not through links in unsolicited texts. Turning on Google Play Protect, keeping devices patched, and revoking accessibility rights for unused apps closes common infection paths. Banks should monitor for sudden UPI or net-banking logins from new devices after toll-related SMS spikes.
State police cyber cells have been asked to take down domains as soon as registrars respond; readers who lose money should file complaints on the national cybercrime portal and preserve screenshots of the fake pages for investigators.
Enterprise playbooks
Logistics firms should segregate phones used for toll payments from devices that access treasury portals, a cheap control that blocks most credential-stealing malware from crossing into corporate banking sessions. Security operations centres can flag DNS queries to newly registered domains that include strings such as “fastag” or “nh-pay”.
National Highways Authority of India maintains official issuer lists on its portal; CERT-In’s advisory urges states to run awareness campaigns at plazas during peak festival traffic. Highway police units in Maharashtra and Karnataka have previously seized SIM boxes tied to smishing rings; this campaign appears to reuse similar infrastructure with new lures.
Users who suspect compromise should deregister compromised devices from UPI profiles, request account freezes through bank hotlines, and rotate passwords from a clean device. Forensic firms note Anubis variants often persist until factory resets because they hide in device administrator profiles.
Bank coordination
Indian Banks’ Association members circulated the CERT-In note to fraud teams, asking branches to flag sudden toll-wallet top-ups followed by immediate UPI transfers to mule accounts. Payment aggregators are scanning merchant onboarding documents for duplicate PAN linkages tied to prior smishing rings.
Telecom operators face renewed pressure to filter SMS headers spoofing NHAI identities; TRAI’s DLT registry violations continue despite penalties. Until headers are cleaned, drivers should treat any SMS balance alert as suspicious.
Rental-car fleets are issuing laminated cards at counters reminding customers not to install toll apps from links in SMS receipts left on dashboards.