Fraudulent Scholarship Apps Target Students in “Defarud” Scam Campaign
## Overview of SikkahBot Malware Targeting Students in Bangladesh
Overview of SikkahBot Malware Targeting Students in Bangladesh
Since July 2024, a malware named SikkahBot has been active, targeting students in Bangladesh. Disguised as applications from the Bangladesh Education Board, it entices users with offers of scholarships, prompting them to share sensitive information and grant high-risk permissions. Once installed, SikkahBot collects personal and financial data, intercepts SMS messages, abuses the Accessibility Service, and performs automated banking transactions, including USSD-based operations.
SikkahBot mimics the Bangladesh Education Board to distribute fake scholarship applications. The malware is distributed through shortened links, redirecting users to malicious APK download sites, potentially using smishing campaigns. It collects personal details and payment information, such as wallet numbers and PINs. Victims are coerced into granting Accessibility Service, SMS access, call management, and overlay permissions, enabling deep device control. SikkahBot intercepts bank-related SMS, abuses the Accessibility Service to autofill credentials in banking apps, and executes automated USSD transactions. The malware maintains low detection rates on VirusTotal , while newer variants show enhanced automation features, suggesting ongoing development by threat actors.
Upon installation, SikkahBot requests users to enable the Accessibility Service, grant SMS access, manage calls, and allow overlays. These permissions provide the malware with extensive control over the device.
SikkahBot registers an SMS broadcast receiver to monitor incoming texts related to specific banking keywords and numbers. Detected messages are forwarded to an attacker-controlled Firebase server.
Since July 2024, a malware named SikkahBot has been active, targeting students in Bangladesh.
The malware exploits the Accessibility Service to track user activity in banking applications. When a targeted app is launched, SikkahBot retrieves and injects a PIN from the Firebase server into login fields, bypassing user input.
If victims avoid targeted banking apps, SikkahBot resorts to USSD-based fraud, fetching codes from the Firebase server, initiating calls, and simulating input in USSD dialogs to perform transactions without an internet connection.
Initial SikkahBot samples relied on phishing and SMS interception for fraud. Since September 2025, enhancements have been observed, including Automation Service integration, indicating evolving tactics. Despite its long-standing presence, the malware maintains low detection rates on VirusTotal, highlighting its ability to evade security measures.
SikkahBot exemplifies a sophisticated campaign targeting Bangladeshi students under the guise of scholarship aid. Through phishing, SMS interception, Accessibility Service abuse, and offline USSD automation, attackers extract personal and financial data and conduct unauthorized transactions. The malware's low detection profile underscores the importance of heightened mobile security controls and proactive defense strategies. Organizations and individuals should exercise caution, scrutinize unsolicited downloads, and limit risky permissions to unverified apps.
Based on reporting by GBHackers.