NPCI Breaks Silence On ‘Digital Lutera’ Malware Report, Here is What it Said About UPI Security

India’s digital payments ecosystem recently came under scrutiny after a cybersecurity report claimed that fraudsters were using a malware toolkit called “Digital Lutera” to bypass certain security features of UPI apps. 

But the National Payments Corporation of India (NPCI) has now responded to the claims, offering clarity on the safety of the country’s fast-growing payments network.

The response comes after cyber intelligence firm CloudSEK said it had identified multiple online groups discussing and distributing the toolkit, which it claims can manipulate device-level security to intercept banking verification messages and one-time passwords (OTPs).

NPCI Issues Clarification on Security Concerns

Responding to the report, NPCI said that the Unified Payments Interface (UPI) has been designed with multiple layers of security and authentication mechanisms to ensure that transactions remain safe.

The payments body also emphasised that it continuously works with banks and ecosystem partners to monitor potential threats and strengthen security frameworks across the digital payments ecosystem.

What The Cybersecurity Report Claimed

CloudSEK’s report alleged that fraudsters are circulating a toolkit called Digital Lutera across messaging platform Telegram, where several groups are reportedly discussing and distributing the software.

According to the cybersecurity firm, attackers may trick users into installing a malicious APK file disguised as routine content, such as a traffic fine notice or a wedding invitation. Once installed, the malware could gain access to SMS permissions on the victim’s phone.

Researchers claim this access could allow attackers to intercept verification messages or OTPs required during UPI registration or banking authentication processes.

SIM-Binding and Device Trust at the Centre of the Debate

One of the key security mechanisms in UPI apps is SIM-binding, which verifies that the bank account is linked to the mobile number installed on a specific device.

CloudSEK warned that if attackers manipulate the operating system of a phone, certain verification processes could potentially be compromised. However, NPCI reiterated that UPI’s multi-layer security architecture is designed to detect and manage such threats.

Read more: Flipkart IPO Plans Take Shape as Walmart-Backed E-Commerce Giant Prepares to Invite Banks.

Conclusion

The discussion around the “Digital Lutera” malware highlights the growing sophistication of cyber threats as digital payments scale rapidly in India. While cybersecurity researchers have raised concerns about possible vulnerabilities, NPCI maintains that UPI continues to operate with strong safeguards and ongoing monitoring to keep transactions secure.

Disclaimer: This blog has been written exclusively for educational purposes. The securities mentioned are only examples and not recommendations. This does not constitute a personal recommendation/investment advice. It does not aim to influence any individual or entity to make investment decisions. Recipients should conduct their own research and assessments to form an independent opinion about investment decisions. 

Investments in the securities market are subject to market risks. Read all the related documents carefully before investing.