India orders Firebase takedowns as Android malware impersonates major banks

India’s cybercrime authorities have directed Google to remove hundreds of accounts associated with alleged misuse of its Firebase development platform after investigators identified a pattern of criminals using the service to distribute malware, impersonate major banks and collect sensitive financial information from victims.

The Indian Cyber Crime Coordination Centre, which operates under the Ministry of Home Affairs, issued takedown instructions affecting at least 57 Firebase-hosted websites and databases during August alone. Government notices identified phishing pages imitating State Bank of India, ICICI Bank and Axis Bank, while other Firebase resources were allegedly being used to receive information stolen from infected Android phones, including credit-card details and one-time passwords.

The notices did not accuse Google or Firebase of participating in the fraud. Google has said it maintains policies prohibiting phishing, malware and financial fraud and works with law-enforcement agencies including the Indian Cyber Crime Coordination Centre to review and act on removal requests.

How were criminals allegedly using Google Firebase to target Indian bank customers?

Firebase is a Google-owned platform used by developers to build applications, host websites, operate databases and manage backend functions without creating all of the underlying infrastructure themselves. Those same capabilities can become attractive to criminals because they make it comparatively easy to deploy web pages, store information and connect mobile applications to cloud databases.

Indian investigators identified Android malware presented to users as legitimate banking services. Victims were allegedly attracted through offers involving new credit cards, reward redemptions or credit-limit upgrades and then encouraged to install applications that appeared to be connected with trusted financial institutions.

Once installed, the malicious application could collect information from the device and send it to infrastructure hosted through Firebase. Seven of the 57 websites and databases named in three August notices were phishing pages resembling State Bank of India, ICICI Bank and Axis Bank, while the remainder were described as infrastructure used to collect information extracted from victims’ phones.

That distinction is important because the operation goes beyond conventional phishing pages designed simply to capture a username and password. Malware running on the device can potentially intercept one-time passwords, read messages or interact with other applications, increasing the attacker’s ability to defeat authentication systems designed to protect financial transactions.

How did the same malware approach allegedly exploit the PM-KISAN programme?

Government authorities also identified a variation targeting beneficiaries of PM-KISAN, the central programme under which eligible farmers receive periodic income-support payments. Fraudulent websites allegedly offered recipients assistance in claiming their payments and instructed users to download an application.

The application could then transmit information from the victim’s phone to a Firebase database controlled by the attacker. This type of attack is particularly effective because it borrows the identity of a trusted government programme rather than relying on an unfamiliar commercial brand.

Cybersecurity researchers sometimes describe malware capable of obtaining extensive device permissions as creating an “Android God Mode” scenario because the attacker can gain unusually broad access to a compromised handset. Indian authorities have previously warned users about malicious applications impersonating banking, government and utility services and distributed through links rather than trusted application stores.

The broader lesson for consumers is that the apparent legitimacy of the institution named in a message does not establish the legitimacy of an application download. Banks and government agencies can be impersonated with convincing logos, terminology and website layouts, while the underlying application may have no connection with the institution being represented.

Why is cloud-platform abuse becoming a bigger challenge for India’s cybercrime authorities?

Authorities have traditionally disrupted online scams by blocking malicious domains, telephone numbers and bank accounts. Cloud development platforms complicate that model because legitimate infrastructure used by millions of developers can also host individual pages, databases or applications created by criminal actors.

The Indian government has observed scammers migrating towards Firebase from other free tools, attracted in part by its accessible hosting and database capabilities. That does not make Firebase inherently unsafe, but it demonstrates how criminals adapt when previous distribution channels become easier for authorities and technology companies to disrupt.

The scale of India’s digital financial ecosystem makes the issue particularly consequential. Unified Payments Interface transactions reached 24,161.69 crore in FY2025-26, equivalent to more than 241 billion transactions, with a total value of ₹314.23 lakh crore.

UPI alone accounted for about 85% of India’s digital payment transaction volume during the financial year. With approximately 55.49 crore users onboarded by June 2026, the system provides enormous convenience but also creates a very large population for fraudsters to target through social engineering, malicious applications and impersonation attacks.

The challenge for regulators and technology platforms is therefore increasingly focused on speed. Criminal infrastructure can be created rapidly on legitimate services, meaning detection, notification and takedown procedures need to operate fast enough to prevent a malicious page or database from remaining active while large numbers of victims are being targeted.

What does the Firebase crackdown mean for Google, Indian banks and digital-payment security?

For Google, the case highlights the moderation and abuse-prevention burden attached to developer infrastructure as cloud platforms become embedded in both legitimate software creation and criminal operations. Google is not accused of creating the scams, but repeated use of a platform by malicious actors increases pressure on providers to improve automated detection, account verification and rapid response to law-enforcement notices.

Alphabet shares had fallen 1.17% on August 20, closing at $340.67, after trading broadly weaker during the preceding sessions. There is no clear evidence that the Firebase enforcement action was responsible for that movement, and the scale of the takedown requests is unlikely on its own to represent a material financial event for a company the size of Alphabet. Investor relevance lies more in the longer-term regulatory cost of policing large cloud and application ecosystems than in the individual removal notices.

For Indian banks, the incident reinforces a different problem: criminals do not need to compromise a bank’s own computer systems to damage customers or the institution’s reputation. A convincing fake application or phishing site can exploit the bank’s brand while operating entirely outside its infrastructure.

Market reaction among the three banks named in the phishing examples was mixed on August 21. ICICI Bank gained about 0.5% while Axis Bank declined roughly 0.3% and State Bank of India was little changed to slightly lower, providing no indication that investors viewed the Firebase disclosure as a bank-specific financial event.

The more significant implication is systemic. As India moves more payments, government benefits and financial interactions onto mobile devices, cybercrime prevention increasingly depends on cooperation among banks, telecom operators, cloud providers, law-enforcement agencies and consumers. The Firebase notices show that authorities are moving beyond individual fraudulent domains towards identifying recurring infrastructure patterns, an approach that could become increasingly important as criminals continue shifting between legitimate digital platforms.