The Indian government has directed Google to take down dozens of websites and databases hosted on Firebase after finding that cybercriminals were allegedly using the platform to impersonate banks, distribute malware, and steal sensitive financial data. According to notices from the Indian Cyber Crime Coordination Centre (I4C), at least 57 Firebase-hosted properties were targeted for removal in August. The case highlights how attackers are increasingly leaning on legitimate cloud services to make scams look more trustworthy.
Investigators said several of the sites were designed to resemble official online services of major Indian banks such as SBI, ICICI Bank, and Axis Bank. Seven of the 57 were reportedly phishing pages built to trick users into entering credentials, while others were used to collect information stolen from victims’ smartphones. The tactics were carefully layered, with fake pages, malicious links, and data collection systems all working together to make the fraud harder to spot.
The I4C also said some campaigns used Android malware disguised as legitimate banking or financial apps. Victims were allegedly lured with offers for new credit cards, reward redemptions, or higher credit limits before being asked to install an app. Once installed, the malware could steal card details, one-time passwords, and other sensitive information, then send it to attacker-controlled infrastructure. Another campaign reportedly abused the PM-KISAN government scheme by promising help with payments and pushing users to download a malicious app.
Security researchers have described similar malware families as “Android God Mode” because they can gain broad access to infected devices and the data stored across multiple apps. In this case, the appeal of Firebase appears to have been its database features and free or low-cost hosting options, which can be abused to create scalable scam operations. That makes legitimate cloud platforms a growing concern for regulators and cybersecurity teams alike.
Google said it has strict policies against phishing, malware, and financial fraud and works with law enforcement agencies, including the I4C, to review abuse reports and remove harmful content. The notices reportedly gave Google just three hours to act, warning of legal action if the flagged links remained live. The episode is another reminder that users should verify banking apps carefully, avoid sideloading unknown APKs, and treat urgent payment or reward messages with caution.
Read the original article: