E Challan Check Pakistan online by CNIC or vehicle number. Verify Punjab PSCA, Islamabad, Sindh, KPK and Balochistan traffic fines instantly.

 India’s cybersecurity agency, CERT-In, has issued an alert about a new Android malware campaign specifically targeting users across the country. The agency has received multiple reports pointing to a coordinated operation by cybercriminals aimed at stealing sensitive financial and personal information through misleading mobile apps and phishing tactics. The attack primarily uses fraudulent messages disguised as official eChallan or RTO challan notifications. Victims receive SMS alerts claiming a traffic violation linked to their vehicle, often accompanied by urgent or threatening language about penalties or legal consequences to prompt immediate action. One commonly reported message states: "Your vehicle challan has been generated. Download the receipt from the link below." These messages include links or attachments that prompt users to download malicious APK files such as “RTO Challan.apk,” “RTO E Challan.apk,” or “MParivahan.apk.” CERT-In explains that these apps initiate a multi-stage malware infection. After installation, the app appears legitimate by showing up in the app drawer. However, it functions only as a dropper, with the actual malicious payload activated when users click prompts like “Install Update.” Multi-Stage Malware and Device Compromise Once triggered, the malware continues to mimic the eChallan theme but becomes hidden from the user by disappearing from the app list. It then aggressively seeks permissions to access SMS, calls, and background processes. With such extensive access, attackers can maintain long-term control over the device without detection. In certain cases, the malware also requests VPN permissions, allowing cybercriminals to monitor and intercept internet activity. The end objective is financial fraud, achieved through fake interfaces that resemble official RTO or banking pages, tricking users into sharing card details and login credentials. In addition to malicious apps, researchers from Cyble Research and Intelligence Labs (CRIL) previously identified a rise in browser-based phishing attacks leveraging the eChallan system. These attacks do not require any app installation, making them easier to execute. Similar to the APK-based approach, victims receive SMS messages with deceptive links. Clicking these links redirects users to cloned websites designed to closely imitate official government portals, complete with logos and branding elements. At the time of investigation, many of these phishing websites were still active, indicating a sustained and organized campaign rather than isolated attempts. Anatomy of the Phishing Attack The browser-based fraud typically follows a structured sequence: * Stage 1: SMS Delivery: Users receive messages about unpaid fines, often including threats of legal action. The sender usually appears as a regular mobile number, adding credibility. * Stage 2: Fake Portal Redirection: Links lead to phishing sites hosted on suspicious IP addresses like 101[.]33[.]78[.]145. Some pages are originally in Spanish and translated into English, suggesting reuse of global phishing kits. * Stage 3: Fabricated Challan Generation: Users are asked to enter details such as vehicle number or license information. Regardless of the input, a realistic challan is generated, often showing a fine (e.g., INR 590) and a near deadline to create urgency. * Stage 4: Financial Data Harvesting: Users attempting to pay are redirected to fake payment pages that collect card details such as CVV, expiry date, and cardholder name. Even invalid card data is accepted, confirming that the goal is data theft rather than payment processing. Further investigation revealed that both the malware and phishing campaigns rely on shared backend infrastructure. Multiple fraudulent domains impersonating eChallan services, logistics companies like DTDC and Delhivery, and financial institutions were hosted on the same servers. More than 36 phishing domains linked to RTO challan scams were discovered on a single server. Another IP address, 43[.]130[.]12[.]41, hosted additional domains mimicking Parivahan services using deceptive naming patterns such as “parizvaihen[.]icu.”

CERT-In has reported a coordinated Android malware campaign targeting Indian users that uses fake eChallan and RTO Challan SMS alerts to trick victims into downloading malicious APKs. The multi-stage dropper installs hidden payloads that request sensitive permissions, can establish VPNs to intercept traffic, and lead to financial theft via fake RTO...

CERT-In warns of an Android malware campaign using eChallan and RTO Challan scams to steal financial data via APKs and phishing sites.

Have you received a traffic fine and are wondering how to pay it quickly and easily? Traffic violations are common in India, and many drivers have faced penalties at some point. The New Motor Vehicles Act of 2019 has made enforcing traffic rules and improving road safety easier. The eChallan payment system has been introduced to streamline traffic fine payments.

Sindh’s e-challan system punishes drivers while ignoring broken roads, poor planning, and state negligence, and accountability without reform

Introduction: A sophisticated phishing campaign is exploiting public trust in government services by impersonating India's official eChallan portal. Cybercriminals are deploying SMS messages that falsely allege traffic violations, directing mobile users to fraudulent websites designed to steal payment card information. This incident highlights the evolving tactics of threat actors who leverage urgency and official impersonation to bypass user skepticism, primarily targeting the increasingly mobile-first population.

Introduction QR codes are widely used for payments, authentication, and data sharing, but their integration into government platforms can introduce critical vulnerabilities. A recent discovery by security researcher Karthikeyan V exposed a flaw in India’s Parivahan eChallan system, allowing attackers to generate malicious QR codes hosted on legitimate .gov.in domains. This article explores the technical implications, mitigation strategies, and ethical hacking techniques to identify such vulnerabilities.

A new Android malware campaign targeting Indian users has been reported by the Indian Computer Emergency Response Team, CERT-In. According

Python SDK skeleton for the eChallan Api platform.

CERT-In warns of an Android malware campaign using eChallan and RTO Challan scams to steal financial data via APKs and phishing sites.