CloudSEK warns ‘Digital Lutera’ toolkit is being used to bypass UPI app security checks via Android system manipulation
The Facts
- CloudSEK reported that online fraudsters are using a toolkit called “Digital Lutera” to bypass security features of UPI apps and conduct fraudulent financial transactions.
- CloudSEK said it identified at least 20 active Telegram groups, each with over 100 members, where “Digital Lutera” is discussed, distributed, and operationalised.
- CloudSEK researcher Shobhit Mishra described “Digital Lutera” as a “structural attack on device trust,” warning that when the operating system is manipulated, safeguards like SIM-binding and app signature checks become unreliable.
- Reports based on CloudSEK’s findings say the technique involves manipulating Android system-level functions rather than directly modifying banking or payment apps.
- CloudSEK’s report says attackers can use malicious APKs to obtain SMS permissions and intercept registration messages and OTPs.
- CloudSEK said its analysis of one Telegram group indicated transactions worth Rs 25–30 lakh were processed over two days.
- NPCI said UPI has multiple/robust security layers and that it is reviewing or has examined CloudSEK’s report.
Context
What is “Digital Lutera,” according to CloudSEK?
CloudSEK describes “Digital Lutera” as a toolkit being shared among fraudsters that enables UPI fraud by undermining device trust—making checks like SIM-binding and app signature verification unreliable when the Android operating system is manipulated NewsBytes,Business Standard.
How is the toolkit being distributed or coordinated?
CloudSEK says it found at least 20 active Telegram groups (each with 100+ members) where “Digital Lutera” is discussed, distributed, and put into use Hans India,NDTV Profit.
What has NPCI said in response?
NPCI has said UPI has robust/multi-layer safeguards in place and that it is reviewing or has examined the CloudSEK report Goodreturns,Outlook Money.
The receipts — all 20 sources
Wire services (1)
Independent coverage (19)
Facts first. Then every angle.
The day’s biggest stories in one short brief — the facts everyone agrees on, then the competing values behind the headlines. Free in your inbox.