Lemon Group Used Preinfected Android Devices for OTP Theft, Hijacking, and Fraud

Trend Micro reported that the Lemon Group, later rebranded as Durian Cloud SMS, operated a large cybercriminal ecosystem built on preinfected Android devices. The malware framework used multiple plugins to monetize compromised phones through SMS interception, proxy services, account hijacking, ad fraud, and silent app installation directed by command-and-control servers. Researchers said the malware could capture one-time passcodes from services including WhatsApp, Facebook, QQ, Line, Tinder, and JingDong, dump Facebook cookies and profile data, hijack WhatsApp sessions, and remotely install or remove APKs without user awareness.

Trend Micro said the operators removed some Lemon branding after earlier public exposure but kept the same infrastructure in place under the Durian Cloud SMS name. Monitoring tied the operation to more than 490,000 mobile numbers used for OTP requests, and infected devices were observed in over 180 countries. The most affected countries included the United States, Mexico, Indonesia, Thailand, Russia, South Africa, India, Angola, the Philippines, and Argentina, indicating a globally distributed mobile fraud and account-compromise operation.