My investigation into illegal and predatory Chinese loan apps

I recently graduated with a bachelor's in computer science (CS) and wanted to try out something interesting. I watched a documentary about those illegal Chinese loan apps that target people in India through ads on platforms like Instagram and Facebook. In 2023, the Indian government asked Play Store to ban thousands of such apps, but they usually come back on Play Store with different names and different UIs. So, if you have ever used these apps, you will notice that several apps have the same login screens, the same app layout, and the same UI. This is because a lot of these apps are controlled by a few Chinese syndicates; if I had to guess, ~30 syndicates control all of these apps. I decided to research them to learn more about cyber security.

Before proceeding, I'd like to let you know that I'm not an expert. Besides CS in college, I also took a cyber security course during my college. It wasn't anything advanced, but I did learn quite a lot of things by myself. So, I'm not an expert, seasoned hacker, but I know enough programming and cyber security to have uncovered a lot of useful information about these apps.

So, let me start with their code design: it's fucking pathetic. These apps aren't really sophisticated, so it wasn't really hard to reverse-engineer their obfuscated code using Frida. They don't contain any advanced malware because developing advanced exploits is a really time-consuming process, and buying one in the black market is really expensive. So, it makes sense that they wouldn't waste their money on a malware that costs hundreds of thousands of dollars, only for it to be discovered by researchers and patched within a few days.

Instead of relying on malware, what they do it pretty simple: they force the users to voluntarily give access to sensitive data on their phone, which includes their contacts, call logs, SMSs, media files, and location. Unless the user provides permissions to access this data, the app won't proceed. If you are desperate for money, you probably wouldn't give a second thought about giving it the permissions it asks for because you urgently need money. Once the permissions are granted, these apps will silently siphon all the data on your phone and send it to their Command and Control (C2C) servers. I checked where the API requests lead to, and all of them lead to servers in China. So, they apps look like they are from Indian companies, but they are actually developed and operated from China.

Now, since I'm doing this research independently, I'm not really funded by anyone, nor do I have lots of money to buy advanced tools. I used my old phone — a Vivo V19 — for this research. Hooked it up to my laptop and debugged the applications using Frida to analyze the API endpoints. I spent several days populating the phone with realistic dummy data to prevent these apps from flagging my device as a research sandbox. It is really important to inject very realistic dummy data into your phone, as the data sent to these C2C servers is analyzed using their ML algorithms to check for anomalies, and they have the ability to determine whether you imported all the data at once.

I downloaded several apps, more than 20, on my burner phone and repackaged them using Frida hooks, which would allow me to monitor all the requests it sends and receives. Most of them were from the same developer, so I deleted the duplicate ones. Got approved for a loan of Rs. 4,000 from the first one, Rs. 1,200 from the second one, Rs. 3,200 from the third one, and so on. Surely enough, most of the apps didn't have a confirmation phase and they directly transferred the money in my account. And after just 5 days, I started receiving threatening messages with my morphed nudes. It's been three weeks since this happened. I got a combined total of somewhere around Rs. 47,000 from these apps. The frequency of calls has reduced over the past week because they have learnt that I'm a dead end and won't pick up.

One of the apps had a vulnerability which allowed me to send an arbitrary file with an access-control mechanism. I was able to get my hands on some of their API keys. This allowed me to gain administrative privileges on one of their servers, but I wasn't able to do much, since the application was loosely coupled. Anyway, I'm still researching them and learning more about how they work. I hope to further break into their servers and wipe their databases of the stolen data that they have collecting from innocent people. So many people have lost their careers and even lives because of these apps. I just want to do as much damage to them as possible with my cyber-security and computer science skills. If you have any questions, feel free to ask them below.