Joker Android malware kept infiltrating Google Play to steal SMS and commit subscription fraud

The Joker Android malware repeatedly infiltrated Google Play through seemingly legitimate apps, where it used multistage payload delivery, dynamic code loading, and heavy obfuscation to evade review while stealing SMS messages, contacts, device data, and notification content. Researchers tied campaigns across dozens of apps and hundreds of thousands of installs, including trojanized utility, wallpaper, camera, and medical-themed applications. Multiple reports showed Joker hiding malicious logic in ad frameworks, splash-screen code, packed APKs, Apache Cordova components, and runtime-loaded .dex or .jar files, with some samples using DexClassLoader, JavaScript-to-Java bridges, and notification-listener abuse to capture one-time PINs and SMS content without directly requesting sensitive permissions.

The malware’s primary objective was premium-service fraud: it identified victims by SIM or mobile country code, selectively targeted users in specific countries, intercepted verification messages, and silently enrolled devices in premium WAP or premium SMS subscriptions. Analysts observed infrastructure hosted on domains and cloud storage including Aliyun OSS, as well as payload concealment through GitHub-hosted resources, while newer variants unpacked themselves at runtime with commercial packers and fetched additional stages from remote servers before activating classes absent from the original APK. Google removed identified malicious apps from the Play Store, but the reporting showed Joker remained active for years and continuously adapted its delivery and evasion techniques to sustain mobile fraud operations.