7 Dangerous Applications Targeting Mobile Banking Balances

Cybersecurity in Indonesia is facing a serious threat as of June 2026. According to the latest research data, the greatest threat to mobile banking (m-banking) balances does not come from official banking applications, but rather through the distribution of fake APK (Android Package Kit) files sent via sideloading schemes. The modus operandi used by perpetrators is to send files through WhatsApp, SMS, or fake links with various enticing lures. Once installed, these applications will request sensitive access permissions such as Accessibility Service, SMS, and even Remote Control to steal OTPs, PINs, and take full control of the device. An important warning: Bank Indonesia, along with major banks such as BCA, BRI, and Mandiri, emphasise that official applications are only available on the Google Play Store and App Store. Never download APK files from unknown sources. Based on technical analysis, the applications above generally contain malware variants such as Rokarolla or BankBot. The advantage of this malware is its ability to steal credentials and intercept sensitive data. If you have accidentally downloaded or installed one of the files above, immediately take the following emergency steps: disconnect the device from the internet, uninstall the suspicious application, and change all banking passwords and PINs using a secure device. Always remember: official institutions never send documents or applications in .apk format via instant messaging applications. Stay vigilant and protect your personal data.