Pentasysai Security Solutions

02/11/2026

A caller says he is from your bank. A "Card Protection Plan" got activated on your card, and to cancel it you only need to install an app he will send you. Hang up.

Group-IB researchers have tracked this script in a campaign called CyberDakait, aimed at Indian bank customers since July 2025. The fake app reads your SMS, including OTPs, asks for card and net-banking details, and mines cryptocurrency on your phone. They counted nearly 18,000 infected phones.

Three rules for the family group:
1. A bank will never ask you to install an app from a call or a link.
2. A "Play Store update" page opened from a message is fake.
3. If you shared anything, call your bank on the number printed on your card, then report on 1930.

Building a banking or fintech app? We test Android apps for SMS, permission and overlay abuse: https://pentasys360.com/cybersecurity.html?utm_source=facebook&utm_medium=social&utm_campaign=PentaReachAI_202610&utm_content=d-20261030-fb-01



https://pentasys360.com/cybersecurity.html?utm_source=facebook&utm_medium=social&utm_campaign=PentaReachAI_202610&utm_content=d-20261030-fb-01

29/10/2026

Got an SMS about a traffic challan with a link to pay? Stop before you tap.

Researchers reported on 16 October a new Android malware called GhostBat. It targets 60 Indian banking, UPI, and wallet apps, including Google Pay, PhonePe, Paytm, BHIM, and SBI UPI. It spreads through fake eChallan and mParivahan messages and fake Play-Store-style download pages.

Once installed, it misuses Android's accessibility feature to record your UPI PIN taps, reads OTP messages, and can forward your calls. Your payment app keeps working normally, so most people never notice.

Three habits that stop it:
1. Install apps only from the Play Store, never from a link in a message.
2. If a "challan" or "vehicle" app asks for accessibility or SMS access, uninstall it.
3. If something feels wrong, call your bank, then report it on 1930 or cybercrime.gov.in.

Share this with your family group. Building a fintech or payment app? We test Android apps against exactly this kind of overlay and accessibility abuse.

29/10/2026

Your website might be running code from 2012, and nothing on the homepage would tell you.

On 21 October the PHP project fixed two critical flaws now called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). A single unauthenticated request can lead to code running on your server. CISA listed both as actively exploited on 26 October, and CERT-In issued an advisory written specifically for MSMEs.

For most Indian SMEs the hard part isn't the patch. It's knowing what you run.

The check we do this week:
→ Ask your host or vendor which PHP version each site uses. Fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35.
→ On 8.1 or older? There is no official patch. Plan the upgrade.
→ In containers, run php -v inside the running container, not the image tag.
→ Restart services and confirm the new version is actually live.
→ Review logs for new admin accounts, changed files, and odd outbound connections.

Exposed is not the same as hacked. Unknown is the risky part.

Not sure what your stack runs? DM us 'PHP' and we'll help you map it.

Call now to connect with business.