Loading malware…
GriftHorse is an Android premium-service fraud operation commonly characterized as fleeceware. It relies on large numbers of seemingly benign mobile applications that lure users with ordinary utility or entertainment themes and then manipulate them into enrolling in recurring paid mobile services without informed consent. The scheme is associated with premium SMS and carrier-billed subscription abuse rather than traditional device compromise for espionage or destructive purposes. Victims can continue to incur recurring charges after interacting with the fraudulent subscription flow, and the campaign has been discussed alongside other Android mobile billing-fraud operations such as UltimaSMS and Dark Herring. GriftHorse targets Android users and is notable for monetization through deceptive subscription enrollment rather than overtly malicious functionality such as ransomware or banking theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a comparison point to distinguish SMSFactory from other recent TrojanSMS campaigns.
Android fleeceware/billing fraud operation used as a comparison point for a similar premium service abuse campaign.
Referenced as another premium SMS scam family illustrating the broader resurgence of this scam type.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.