Android Malware Used 250 Fake Apps for Silent Carrier-Billing Fraud

Researchers at Zimperium’s zLabs uncovered a large Android malware campaign that used nearly 250 malicious apps to silently subscribe victims to premium carrier-billing services and abuse premium SMS flows without consent. The apps impersonated well-known brands and games including Facebook Messenger, Instagram Threads, TikTok, Minecraft, and Grand Theft Auto, and targeted users in Malaysia, Thailand, Romania, and Croatia. The operation was active from March 2025 through January 2026, with some attacker infrastructure still online at the time of reporting.

zLabs identified three malware variants that activated only when a device’s SIM matched specific mobile operators, helping the fraud remain hidden from non-targeted users by showing benign fallback pages. The malware used hidden WebViews and JavaScript to automate subscription pages, intercepted one-time passwords through Google’s SMS Retriever API, disabled Wi‑Fi to force cellular billing, stole cookies, sent delayed premium SMS messages, and reported activity through attacker-controlled Telegram channels. Researchers said the infrastructure supported command-and-control, victim tracking, analytics, and exfiltration of device metadata and billing-page content.