Qwizzserial
Qwizzserial is an Android SMS-stealer observed in campaigns targeting users in Uzbekistan. Group-IB reported roughly 100,000 infections, with most victims in Uzbekistan, where SMS is commonly used for two-factor authentication. The malware has been described as harvesting SMS inbox contents, intercepting SMS messages, collecting phone numbers, bank card data, and enumerating installed financial or banking apps. Reported exfiltration methods include Telegram bots and HTTP POST requests. Qwizzserial has been distributed through Telegram-based social engineering, including Telegram channels posing as government agencies and fake financial-aid applications, and has also been found disguised as seemingly benign media files. It has been observed alongside broader Uzbekistan-focused Android malware activity involving other families such as Wonderland, and is described as part of campaigns abusing sideloaded APKs delivered via Telegram. High-confidence reporting links Qwizzserial to theft of sensitive financial and authentication-related data from Android users in Uzbekistan.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Qwizzserial is an Android malware that harvests phone numbers, bank card data, SMS inbox contents, and details of installed banking apps, exfiltrating data via Telegram bots or HTTP POST requests. It is distributed through Telegram channels posing as government agencies, often using fake financial aid apps as lures.
Obfuscated Android malware strain distributed as benign media files.
Android SMS stealer used in Telegram-propagated APK campaigns targeting users in Uzbekistan.
Android malware designed to collect information on financial apps and intercept SMS messages, targeting users in Uzbekistan.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.