Thousands of Indian User’s Data are being leaked Through the LoanBee App
Fake digital lending apps are growing nowadays and provide short-term loans to users who are especially vulnerable and low income-group people. These fraudulent apps exploit borrowers by charging an excessive interest rate, recovering the loan money in an unethical way, and breaching data privacy. The group behind these fraudulent apps also steals users’ sensitive data for harsh loan recovery by blackmailing and harassing them.
Recently, Cyble Research & Intelligence Labs (CRIL) discovered leaked data of over 26500 Android users from India through the backend server of an Android application called LoanBee. Based on our research, we identified that the LoanBee is a digital lending application that steals users’ sensitive data. This application was primarily hosted on Google Play Store with more than 100,000 installs, and now it has been removed from Google Play Store due to its unusual behavior. The figure below demonstrates the LoanBee application’s removal from the Google Play Store.

Though this application has been removed from Google Play Store, it is still available on various third-party app stores such as apkcombo.com, apkmonk.com, and apkfollow.com. Refer to figure 2.

During successful installation on the Android device, this malicious application steals sensitive information such as device information, saved contacts, and SMSs and uploads the stolen data to the remote server.
The leaked data discovered by CRIL includes saved contact numbers, SMSs, basic device information, etc. The below figure demonstrates the sample of leaked Victim’s Contacts and SMSs data.

The image below depicts the part of the leaked victim device’s basic information, including the installed applications list, hardware information, manufacturer details, etc.

Technical Analysis
APK Metadata Information
- App Name: LoanBee
- Package Name: com.loanbee
- SHA256 Hash: 58d090b5ebf57a6af671a02b3b5719591cf2cb0d28de0ec4ebf2dc5393f79320
Figure 5 shows the metadata information of the application.

Manifest Description
The malware requests 11 different permissions from the user, out of which it abuses at least 7. These dangerous permissions are listed below:
Permissions | Description |
ACCESS_NETWORK_STATE | Allows the app to view information about network connections |
READ_PHONE_STATE | Allows access to phone state, including the current cellular network information, the phone number and the serial number of this phone, the status of any ongoing calls, and a list of any Phone Accounts registered on the device. |
READ_SMS | Access phone messages |
READ_CONTACTS | Access phone contacts |
ACCESS_COARSE_LOCATION | Allows the app to get the approximate location of the device network sources, such as cell towers and Wi-Fi |
ACCESS_FINE_LOCATION | Allows the app to get the precise location of the device using the Global Positioning System (GPS) |
RECEIVE_SMS | Allows an application to receive SMS messages. |
Source Code Review
The malware uses the code snippet below to read the device’s contact data. These data could be misused by the people behind these fraudulent lending apps to blackmail the loan borrowers and threatens them by sending an inappropriate message to their contacts via SMSs, WhatsApp, etc.

The malware uses the code below to collect the SMS data available on the victim’s device. This fraudulent lending group can use stolen SMS data to perform various malicious activities such as stealing contact details, bypassing two-factor authentication, etc.

The image below contains the malware’s code to intercept incoming SMSs. The incoming SMSs can contain One-Time-Password (OTP) and other sensitive information.

The code snippet below shows the malware’s capability to collect the victim’s basic device information, such as IMEI, OS info, device type, etc.

The below-shown code flow demonstrates malware uploading device data to the server through the URL: hxxps://api.loanbee[.]tech/v1/collect/upload.

Below figure 11 depicts the domain information of the URL: hxxps://api.loanbee[.]tech/v1/ through which the data is being uploaded to the server.

The application sends the data collected from the victim’s device to the server through the POST method. Further, the stolen data can be sold through deep/darkweb marketplaces.
Conclusion
In the above analysis, we have demonstrated how a fraudulent digital lending application steals users’ sensitive data. The LoanBee application had installations in lakhs before it was removed from Google Play Store.
In the past, we have seen many instances of illegal loan apps with five-star reviews and the occasional verified badge on the google play store. Still, they were generated automatically by bots to appear legitimate. Users should download digital lending apps by verifying the platform’s registration with regulatory bodies like RBI, SEBI, etc.
Our Recommendations
We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:
How to prevent malware infection?
- Verify the authenticity of the application.
- Don’t allow permissions if this is not relevant to the application.
- Download and install software only from official app stores like Google Play Store or the iOS App Store.
- Use a reputed anti-virus and internet security software package on your connected devices, such as PCs, laptops, and mobile devices.
- Be wary of opening any links received via SMS or emails delivered to your phone.
- Ensure that Google Play Protect is enabled on Android devices.
- Keep your devices, operating systems, and applications updated.
How to identify whether you are infected?
- Regularly check the Mobile/Wi-Fi data usage of applications installed on mobile devices.
- Keep an eye on the alerts provided by Anti-viruses and Android OS and take necessary actions accordingly.
What to do when you are infected?
- Disable Wi-Fi/Mobile data and remove SIM cards – as in some cases, the malware can re-enable the Mobile Data.
- Perform a factory reset.
- Remove the application in case a factory reset is not possible.
- Take a backup of personal media Files (excluding mobile applications) and perform a device reset.
What to do in case of any fraudulent transaction?
- In case of a fraudulent transaction, immediately report it to the concerned bank.
What should banks do to protect their customers?
- Banks and other financial entities should educate customers on safeguarding themselves from malware attacks via telephone, SMS, or emails.
MITRE ATT&CK® Techniques
Tactic | Technique ID | Technique Name |
Initial Access | T1475 T1476 | Deliver Malicious App via Other Means. Deliver Malicious App via Authorized App Store. |
Execution | T1575 | Native Code |
Collection | T1636.004 T1636.003 | Capture SMS MessagesCapture Contact List |
Command and Control | T1436 | Commonly Used Port |
Indicators of Compromise (IOCs)
Indicators | Indicator Type | Description |
8b96a7368b27503e9e0998dde5012c62 | MD5 | LoanBee APK |
9c47df8d20fd30dc30bac26ae2c8fe1a7bf1e0ac | SHA1 | LoanBee APK |
58d090b5ebf57a6af671a02b3b5719591cf2cb0d2 8de0ec4ebf2dc5393f79320 | SHA256 | LoanBee APK |
hxxps://api.loanbee[.]tech/v1/ | URL | API Used to Upload Data |