So uhh the ban from @supabase didn't work. The scammer probably has dozens of burner accounts and is still actively using Supabase of their operations.
It has been good few days ladies and gentlemen. First Github FINALLY took action and brought down a Github account which was spreading APKs of obviously fake Indian banking apps and then few days later yesterday I let Supabase know someone is using their platform as C2 as well +
Now that has been brought down as well the scammer had literally put the Supabase project URL and the Key with mis-configured project permissions due to which I (once again) had gained full read and write permissions. I had contacted Axis Bank and CERT-In as well but no response.
It has been good few days ladies and gentlemen. First Github FINALLY took action and brought down a Github account which was spreading APKs of obviously fake Indian banking apps and then few days later yesterday I let Supabase know someone is using their platform as C2 as well +
Feeling really humbled trying to analyze a malicious APK without any internet. I don't have internet for 2 days now and using my aunt's slow wifi to write this tweet.
hey @github how long and what does it take to make you deactivate an account that is clearly spreading various malicious APKs? Because I am sure I had reported the whole thing to you in or around August and the malicious github account, APKs are still up. https://t.co/hCSyuQ1Q2K