hdfc-1-81195.firebasestorage.app

domain C2 not resolving

Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-07T08:32:22

Registration

Registrar: -
Registered: -
Expires: -

DNS

Resolves to: -
Nameservers: -
Status: -

Observed in malware

Family	Sample SHA-256	Role	First seen
HDFC Card Stealer (provisional)	9beab3f4aec1…	C2	2026-10-03

About HDFC Card Stealer (provisional)

**HDFC Card Stealer** (provisional) is an Android phishing/stealer impersonating **HDFC Bank** (India). It presents fake card and net-banking entry screens and exfiltrates captured card numbers, CVV, expiry, credentials and OTP data to a Google Firebase backend (hdfc-1-81195-default-rtdb.firebaseio.com and hdfc-1-81195.firebasestorage.app). Part of the wave of India-targeting bank-phishing APKs that use Firebase as a zero-infrastructure exfil endpoint.

Signing certificate

Subject CN: Android
Issuer CN: Android
Valid: 2008-02-29 → 2035-07-17
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.