Fake SBI / ICICI / Axis Bank page on Google Firebase asks you to install a malware app
A scammer hosts a convincing fake bank or government-scheme page on Google Firebase. You install a 'helper app' that silently intercepts OTPs, overlays fake screens on your real banking app, and gives the attacker full remote control of your phone.
Also known as: Firebase bank fraud, Android God Mode malware, fake SBI Firebase page, PM-KISAN Firebase APK scam, Firebase credit card reward scam
Already happened to you? Do this in the next few minutes
Call 1930 now- 1 Call 1930 — the national cyber-crime helpline — right now. The sooner you report, the better the chance of freezing the money before it moves.
- 2 Call your bank to freeze the account and block the card immediately. Use the number printed on your card, never a number from the message or caller.
- 3 File a report at cybercrime.gov.in and keep every message, screenshot, and transaction ID.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Never open a bank link from SMS or WhatsApp — always type your bank's URL directly or use the official Play Store app
- 2 If a page asks you to download an APK (not from the Play Store), close it immediately — no legitimate bank or government scheme distributes apps this way
- 3 If you installed the app: remove your SIM card immediately and call your bank from a different phone to freeze your account and block all UPI and net-banking
- 4 Factory-reset your phone before reinserting the SIM — Accessibility-exploit malware survives uninstall attempts
- 5 Report the Firebase URL to cybercrime authorities — I4C actively processes Firebase takedown requests
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ A link arrives via SMS, WhatsApp, or a search ad pointing to a page that looks like your bank's website but the URL ends in .web.app, .firebaseapp.com, or another non-bank domain
- ⚠ The page asks you to download an APK to 'verify your account', 'claim a reward', or 'receive a government payment' — real bank sites never push APK downloads
- ⚠ After installation, the app requests Accessibility Services permissions — this is the 'God Mode' step; no legitimate banking app asks for this
- ⚠ You start receiving OTP alerts for transactions you did not make
- ⚠ Your banking app screen briefly flickers or shows a slightly different login screen
Known variants
-
AI-built fake banking APKs distributed via WhatsApp and Telegram (Surat teen network, July 2026): Teenagers used AI tools to build 121 fake SBI, ICICI, HDFC, Axis Bank apps; sent via WhatsApp/Telegram claiming KYC expiry or account upgrade; same OTP-interception and Accessibility-Services exploit as Firebase variant; ₹64.38 crore stolen from 2,928 victims.
Last seen: 8/27/2026
Sources
- Business Standard — Govt orders removal of Google Firebase accounts after spotting scam pattern (Aug 21, 2026)
- Moneylife — Fraud Alert: One APK, Total Takeover — The Rising Threat of 'Android God Mode' Malware
- Asianet News Hindi — Android God Mode: Google Firebase Bank Fraud (Aug 2026)
- The420.in — Android God Mode malware fake APK banking fraud India