Loading malware…
Joker, also known as Bread, is an Android spyware and billing-fraud malware family active since at least 2017. It is distributed through seemingly legitimate applications, particularly on Google Play, including wallpaper tools, messaging apps, games, and other utilities. Infected applications may retain their advertised functionality while covertly subscribing users to premium services or sending premium-rate SMS messages. Joker also collects and exfiltrates SMS messages, contacts, and device information.
Joker automates premium subscription workflows through background web interactions, JavaScript injection, form submission, and interception of SMS authorization codes. Variants abuse notification-listener access to extract verification codes without directly requesting SMS-reading permission and can suppress notifications to conceal fraudulent activity. Command-and-control servers supply subscription instructions and dynamically executed code over HTTP. Activation commonly depends on SIM mobile country codes or operator information, allowing campaigns to selectively target subscribers across multiple countries.
The family uses multistage payload delivery and dynamic loading of DEX and JAR components. Evasion techniques include encrypted configuration data, string obfuscation, commercial Android packers, native code, reflection, and Base64-encoded payloads embedded within application metadata or classes. Some variants retrieve malicious components only after receiving server-side activation instructions, limiting exposure during application review. Joker's code and delivery mechanisms have changed repeatedly across campaigns.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware also receives dynamic code and commands over HTTP and runs that code via JavaScript-to-Java callbacks.
Because it implements a JS bridge with JavascriptInterface, it has the ability to run JS code. The commands are passed from the C&C.
To realize the ability of subscribing app users to premium services without their knowledge or consent, the Joker utilized two main components – the Notification Listener service that is part of the original application...
It continues to find new tricks and tactics to stay undetected by doing small changes in its code or changing the payload download techniques.
we recently noticed a new Joker malware sample on Google Play Store, which utilizes Android packers like “Tencent’s Legu” and “ijiami” packers to evade detection
Users may be unaware of any compromise at first glance because the Joker malware sample is contained in a functioning app. The app promises wallpapers and delivers on that promise — the malware is an unfortunate add-on.
GolayEngine.lay() decrypts the 308KB payload via ChaCha20 -> GolayEngine.vcg() executes it
The malware only attacks targeted countries... the victim has to be using a SIM card from one of these countries in order to receive the second stage payload... most of the discovered apps have an additional check, which will make sure that the payload won’t execute when running within the US or Canada.
the actors seem to be seeking a new and effective method to hide the malware’s payload... Another notable change is that the malware now hides everything valuable, such as the fraud URL, on C&C servers.
In this case, all that was needed for the malicious code to run was to read the strings, decode them from Base64, and load it with reflection.
it subscribes users to a WAP service without their knowledge
and android.permission.READ_PHONE_STATE to get the SIM mobile country code. Joker is known to only run on devices with a SIM card (and only for specific SIM country codes).
The malware only attacks targeted countries... the victim has to be using a SIM card from one of these countries in order to receive the second stage payload... most of the discovered apps have an additional check, which will make sure that the payload won’t execute when running within the US or Canada.
This malware attempts to steal SMS messages, contacts from the victim’s device
it subscribes users to a WAP service without their knowledge
The final important thing worth mentioning about the Joker is the phone book contact list theft. The core component collects all numbers in the contact list and sends them over to the C&C in an encrypted form.
The commands are passed from the C&C. Some of the possible commands: ... get – Send a GET request ... post – Send a POST request
AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.
Originally, the code that was responsible for communicating with the C&C and downloading the dynamic dex file was located inside the main classes.dex file, but now the functionality of the original classes.dex file includes loading the new payload.
submitForm - Submit form data via post request to C&C
156 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.