Somewhere in India this September, a phone buzzed with a text:

Pay Challan ₹500 within 2 hrs to avoid penalty.

If the answer to both was “yes,” the system allowed the session to proceed.

The warning of an unpaid traffic fine was a trap. Following the link led to a malicious Android app installed from outside the Google Play Store. Once installed, the app requested permission to read and write text messages and access the phone's accessibility services. Together, those permissions gave attackers near-total control of the device, a level of access researchers call "Android God Mode."

From there, attackers could intercept banking text messages and one-time passwords (OTPs), sending the stolen information to an unsecured Google Firebase database, a cloud-based service for storing and accessing data. A control panel let them retrieve that information in real time, allowing them to drain victims’ bank accounts before the OTPs expired.

And this wasn’t an isolated operation. In August, the Indian Cyber Crime Coordination Centre flagged 57 of these Firebase-hosted operations impersonating banks. By Sept. 20, that number had jumped to 216, nearly four times the August figure.

The tactics are not new. As early as 2022, security researchers at Zscaler documented similar attacks using fake banking pages hosted on Firebase to steal sensitive information.

Since then, at least four independently developed malware operations have emerged using variations of the same playbook: PM KISAN YOJNA/Salvador, RewardSteal (also known as the RTO Challan family), FatBoyPanel, and a malware-as-a-service kit known as “Hospital Support” or “Emergency Courier.”

Why Firebase?

Indian authorities have identified a growing pattern of scammers using Firebase, with operators migrating to the platform from other free tools. The appeal comes down to three advantages: cost, credibility, and convenience.

Firebase offers free or low-cost services, the credibility of Google’s trusted infrastructure, and a cloud-based database that attackers can use to access stolen information in real time. Because Firebase handles the underlying infrastructure, attackers don’t need to maintain their own servers. Its association with Google may also help malicious activity evade some spam and security filters.

A threat beyond India’s borders

The abuse of Firebase isn’t limited to India. Researchers at Zimperium identified a separate Android malware operation called Arsink RAT that infected approximately 45,000 devices across 143 countries. Indonesia alone accounted for roughly 7,000 infections, second only to Egypt, with India, Pakistan, and Bangladesh also among the affected countries. Behind that reach were 1,216 malicious Android application packages (APKs) routing stolen data through 317 unique Firebase endpoints.

I checked whether these were the same operations as the PM-KISAN or RTO campaigns in India by cross-referencing the malware file hashes and found no overlap. These were distinct operations independently exploiting the same platform.

That pattern extends beyond Asia. In Brazil, several Android malware families targeting the country's Pix instant payment system have used Firebase Cloud Messaging to communicate with infected devices. In another case, attackers impersonated a Rothschild & Co. employee and used a Firebase-hosted phishing page to target banking executives across Africa, Canada, Europe, and the Middle East.

Different operators are arriving at the same conclusion: Why build your own infrastructure when trusted cloud services can do the job? 

AI at play: VibeScamming and beyond

AI is making it easier for cybercriminals to develop and deploy attacks.

In 2025, researchers at Guardio Labs tested what happens when you ask AI to build an app complete with phishing pages. Lovable and Claude complied, generating live phishing pages that sent stolen credentials to Firebase.

While those AI platforms now have much stricter policies in place, the broader practice, sometimes called “VibeScamming,” is gaining attention. The term is a play on “vibe coding,” or using AI to generate software from natural language prompts. Researchers have identified signs of this approach in newer threats, including the RemControl Android banking trojan.

More recently, researchers at Zimperium documented a different use of AI in an Android trojan called RatHat. Rather than simply using AI to help write malicious code, RatHat allows an AI assistant to interact with an infected phone in real time. Using Android's accessibility services, the AI can determine where to tap and scroll as it navigates banking apps, helping the malware steal login credentials and PINs[GD1.1] rather than relying on a hardcoded script.

And financial institutions are already seeing the threat firsthand. BioCatch's 2026 global survey of fraud and risk leaders across 25 countries found that 80% of respondents had already faced an attack carried out by AI agents.

Our 2026 Global Scams report shows nine out of every 10 scams today now originate from a mobile device.

What comes next

Together, these developments point to a potentially more dangerous evolution in cybercrime: phishing pages built from a simple prompt, malware whose code AI helped write, a trojan that lets AI drive an attack in real time, screen by screen. What happens when these capabilities no longer operate in isolation, but all come together?

In theory, an AI agent platform with few safeguards could bring much of that process together, automating everything from building phishing pages and writing malware to deployment, distribution, and the attack itself, live on a victim’s phone.

As AI gives attackers new ways to develop, adapt, and scale their operations, banks face growing pressure to respond just as quickly. Speaking about India's fraud landscape in August, Reserve Bank of India Gov. Sanjay Malhotra didn’t hedge: AI, and only AI, can keep pace with fraud that changes faster than a rules engine can be rewritten.

The same technology helping cybercriminals accelerate their attacks may also be critical to stopping them.

—

Key takeaways:

• Cybercriminals are increasingly exploiting trusted cloud services such as Google Firebase to cheaply host malicious infrastructure, collect stolen data, and evade security controls.   

• Firebase abuse has spread across independent malware operations and multiple countries, suggesting attackers are converging on the same scalable, cloud-based model.   

• AI is lowering the technical barrier to cybercrime by helping attackers create phishing pages, develop malware, and automate elements of an attack from simple natural-language prompts.   

• Emerging malware such as RatHat shows how AI agents can move beyond writing malicious code to actively navigating a victim’s device and banking apps in real time.   

• As cloud infrastructure, mobile malware, and agentic AI converge, financial institutions will increasingly need AI-powered defenses that can identify and respond to attacks as quickly as criminals can adapt them.
  

Resources

• Report: 2026 Global Scams   

• Survey: The future of digital trust: AI agents and the speed of fraud and financial crime    

• Reuters: India orders removal of Google Firebase accounts after spotting scam pattern    

• Zimperiun: The rise of Arsink RAT 

• Hacker News: Six Android malware families target Pix payments, banking apps, crypto wallets