The hardware vulnerability - found primarily in budget handsets - makes it possible to steal sensitive user data, including crypto wallet seed phrases, in less than a minute.

Victims may remain unaware that their UPI account has been taken over on another device as the attack happens silently, as per researchers.

The hacker has been luring users in Brazil to download the fake Starlink app through phishing pages that impersonate the Google Play Store.