Loading malware…
Joker is an Android trojan family, referred to in the source material as Android.Joker, that is primarily designed to subscribe victims to paid services. Doctor Web repeatedly reported discovering Joker-infected apps on Google Play across 2025 and 2026. These trojanized apps were disguised as legitimate software, including messengers, system optimization and utility tools, image-editing and photography apps, camera apps, movie-watching apps, and document/PDF-related apps. Specific examples cited include the Google Play apps Clean Boost and Convert Text to PDF.
The malware’s core behavior described in the content is subscription fraud against Android device owners. Doctor Web states that Joker apps on Google Play subscribed users to paid services; in one Q1 2026 summary, related Android.Subscription samples were specifically noted as using Wap Click flows, but that mechanism is not explicitly attributed to Joker itself in the provided material.
The family was observed repeatedly at scale on Google Play. Doctor Web reported over 50 Android.Joker trojans on Google Play in Q3 2025, over 20 in Q4 2025, multiple samples in Q1 2026 with at least 370,000 installs in total, and continued discoveries in Q2 2026. Across Android.Joker and Android.Subscription together, Doctor Web reported at least 2.6 million total downloads for Google Play samples found in Q2 2026, and its 2025 Android threat review stated that more than 180 threats found on Google Play—including Joker among other families—accounted for more than 2.165 million downloads.
The provided content does not attribute Joker to a specific named threat actor, industry vertical, or geographic targeting beyond Android users exposed through Google Play.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Members of the Android.HiddenAds family are often distributed as popular and harmless applications... The trojans were concealed in a number of tools for optimizing the operation of Android devices, and were distributed under the guise of messengers, multimedia, and other software.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Android trojan family distributed via Google Play that subscribes users to paid services.
Android trojan family distributed via Google Play and disguised as legitimate apps to subscribe victims to paid services.
Android trojan distributed via Google Play that subscribes victims to paid services.
Android trojan family focused on premium-service subscription fraud, distributed via trojanized apps on Google Play.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.