Loading story…
Trend Micro reported that the Lemon Group, later rebranded as Durian Cloud SMS, operated a large cybercriminal ecosystem built on preinfected Android devices. The malware framework used multiple plugins to monetize compromised phones through SMS interception, proxy services, account hijacking, ad fraud, and silent app installation directed by command-and-control servers. Researchers said the malware could capture one-time passcodes from services including WhatsApp, Facebook, QQ, Line, Tinder, and JingDong, dump Facebook cookies and profile data, hijack WhatsApp sessions, and remotely install or remove APKs without user awareness.
Trend Micro said the operators removed some Lemon branding after earlier public exposure but kept the same infrastructure in place under the Durian Cloud SMS name. Monitoring tied the operation to more than 490,000 mobile numbers used for OTP requests, and infected devices were observed in over 180 countries. The most affected countries included the United States, Mexico, Indonesia, Thailand, Russia, South Africa, India, Angola, the Philippines, and Argentina, indicating a globally distributed mobile fraud and account-compromise operation.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that the operation used multiple Android malware plugins for SMS interception, proxy services, account hijacking, ad fraud, and silent app installation. The company said it observed more than 490,000 mobile numbers used for OTP requests and infected devices in over 180 countries.
In May 2022, the operators reportedly removed some Lemon branding and rebranded as Durian Cloud SMS while keeping the same servers intact. This indicated continuity of the operation despite the name change.
Trend Micro published research on the Lemon Group and its preinfected-device cybercriminal ecosystem in February 2022. The reporting identified the operation as using infected Android devices for monetization and abuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026
Multiple reports highlight evolving **Android** threats that abuse SMS/telephony access and advanced evasion to enable fraud, surveillance, and account takeover. CloudSEK described a shift from repackaged apps to **runtime manipulation** using the *LSPosed* framework, where a malicious module (e.g., **Digital Lutera**) hooks `SmsManager` and `TelephonyManager` to undermine India’s **UPI SIM-binding** controls. The technique can intercept registration tokens and 2FA, spoof device identity/phone number, and exfiltrate data to **Telegram**; it also uses **Socket.IO** for real-time C2 and can remotely inject fabricated SMS entries into the device’s “Sent” database to make bank backends believe a SIM is present on a different device, enabling scalable payment fraud and account takeover. Separately, Acronis TRU (reported by Hackread) identified a **fake Red Alert** rocket-warning app distributed via SMS lures impersonating Israel’s Home Front Command; the trojanized app displays legitimate alerts to reduce suspicion while requesting extensive permissions to steal **GPS location**, **SMS/OTP**, contacts, installed-app inventory, and on-device account details, then exfiltrates data to a remote server, including via **certificate spoofing** and UI tricks to appear Play Store-installed. Zimperium reported a new Android RAT, **SurxRAT**, that can download and run **LLM modules** from third-party repositories to automate phishing and social engineering and to interact with apps/UI for credential theft and data exfiltration, reinforcing the need for behavior-based mobile detection, tighter app controls, and stronger integrity enforcement (e.g., *Play Integrity API* with `MEETS_STRONG_INTEGRITY`) where applicable.
Jun 29, 2026
Researchers at Zimperium’s zLabs uncovered a large Android malware campaign that used nearly 250 malicious apps to silently subscribe victims to premium carrier-billing services and abuse premium SMS flows without consent. The apps impersonated well-known brands and games including **Facebook Messenger**, **Instagram Threads**, **TikTok**, **Minecraft**, and **Grand Theft Auto**, and targeted users in **Malaysia, Thailand, Romania, and Croatia**. The operation was active from March 2025 through January 2026, with some attacker infrastructure still online at the time of reporting. zLabs identified three malware variants that activated only when a device’s SIM matched specific mobile operators, helping the fraud remain hidden from non-targeted users by showing benign fallback pages. The malware used hidden WebViews and JavaScript to automate subscription pages, intercepted one-time passwords through Google’s SMS Retriever API, disabled Wi‑Fi to force cellular billing, stole cookies, sent delayed premium SMS messages, and reported activity through attacker-controlled Telegram channels. Researchers said the infrastructure supported command-and-control, victim tracking, analytics, and exfiltration of device metadata and billing-page content.
Jun 29, 2026