HDFC Card Stealer (provisional)

HDFC Card Stealer (provisional) is an Android phishing/stealer impersonating HDFC Bank (India). It presents fake card and net-banking entry screens and exfiltrates captured card numbers, CVV, expiry, credentials and OTP data to a Google Firebase backend (hdfc-1-81195-default-rtdb.firebaseio.com and hdfc-1-81195.firebasestorage.app). Part of the wave of India-targeting bank-phishing APKs that use Firebase as a zero-infrastructure exfil endpoint.