Loading malware…
Joker is an Android malware family primarily associated with premium-service fraud and information theft. Active since at least 2017, it has repeatedly been distributed through trojanized Android applications, including seemingly benign utility, messaging, wallpaper, scanner, camera, health, and personalization apps published on Google Play. In many cases the malicious app remains functional, helping the malware blend in while delaying user suspicion.
Joker commonly operates as a multistage trojan that downloads or reconstructs additional DEX, JAR, or other payloads at runtime. Variants have used dynamic code loading, reflection, obfuscation, encryption, packers, Base64-embedded payloads, JavaScript bridges, and native code to evade static analysis and marketplace vetting. Some samples hide key fraud logic or configuration on remote infrastructure and activate only for selected mobile country codes or SIM operators, indicating geographically targeted campaigns.
Its core activity is toll-fraud and premium-subscription abuse. Joker can silently load subscription pages in WebView components, automate clicks or form submissions, submit authorization data, send SMS messages, and intercept one-time codes or PINs delivered through SMS or notifications in order to enroll victims in paid services without consent. Multiple reports also describe theft of SMS messages, contact lists, device information, and in some cases notification content used to capture verification codes. Command-and-control communications have been observed over standard web protocols such as HTTP, and some variants periodically retrieve jobs or commands from remote servers.
Joker is best characterized as an Android trojan and spyware-infostealer hybrid focused on billing fraud. It has been one of the most persistent malware families on Google Play, with operators continually changing loaders, payload-delivery methods, and concealment techniques to maintain distribution and evade detection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
It continues to find new tricks and tactics to stay undetected by doing small changes in its code or changing the payload download techniques.
we recently noticed a new Joker malware sample on Google Play Store, which utilizes Android packers like “Tencent’s Legu” and “ijiami” packers to evade detection
Users may be unaware of any compromise at first glance because the Joker malware sample is contained in a functioning app. The app promises wallpapers and delivers on that promise — the malware is an unfortunate add-on.
GolayEngine.lay() decrypts the 308KB payload via ChaCha20 -> GolayEngine.vcg() executes it
The malware only attacks targeted countries... the victim has to be using a SIM card from one of these countries in order to receive the second stage payload... most of the discovered apps have an additional check, which will make sure that the payload won’t execute when running within the US or Canada.
and android.permission.READ_PHONE_STATE to get the SIM mobile country code. Joker is known to only run on devices with a SIM card (and only for specific SIM country codes).
The malware only attacks targeted countries... the victim has to be using a SIM card from one of these countries in order to receive the second stage payload... most of the discovered apps have an additional check, which will make sure that the payload won’t execute when running within the US or Canada.
The commands are passed from the C&C. Some of the possible commands: ... get – Send a GET request ... post – Send a POST request
148 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android billing fraud trojan that subscribes victims to premium services and intercepts confirmation SMS or push notifications. This variant uses a Rust-compiled native library with ChaCha20-encrypted payloads and abuses notification listener access to read OTPs, confirm subscriptions, and suppress notifications.
The report also noted ... the reappearance of the Joker and FakeApp malware on Google Play.
...embedding such malware families as Joker, Harly, Coper, and Adfraud.
Android info-stealer observed prominently in Google Play malware detections, though its share declined compared to the prior year.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.