Loading story…
The Joker Android malware repeatedly infiltrated Google Play through seemingly legitimate apps, where it used multistage payload delivery, dynamic code loading, and heavy obfuscation to evade review while stealing SMS messages, contacts, device data, and notification content. Researchers tied campaigns across dozens of apps and hundreds of thousands of installs, including trojanized utility, wallpaper, camera, and medical-themed applications. Multiple reports showed Joker hiding malicious logic in ad frameworks, splash-screen code, packed APKs, Apache Cordova components, and runtime-loaded .dex or .jar files, with some samples using DexClassLoader, JavaScript-to-Java bridges, and notification-listener abuse to capture one-time PINs and SMS content without directly requesting sensitive permissions.
The malware’s primary objective was premium-service fraud: it identified victims by SIM or mobile country code, selectively targeted users in specific countries, intercepted verification messages, and silently enrolled devices in premium WAP or premium SMS subscriptions. Analysts observed infrastructure hosted on domains and cloud storage including Aliyun OSS, as well as payload concealment through GitHub-hosted resources, while newer variants unpacked themselves at runtime with commercial packers and fetched additional stages from remote servers before activating classes absent from the original APK. Google removed identified malicious apps from the Play Store, but the reporting showed Joker remained active for years and continuously adapted its delivery and evasion techniques to sustain mobile fraud operations.
Pull IOCs and campaign context straight into your stack.
14 events from the most recent confirmed update back to the earliest known activity.
On June 19, 2022, ReBensk reported an Android/Joker sample that used encrypted Aliyun OSS URLs and a multistage chain to download and load successive JAR and DEX payloads, including components named seek and Yang. Cryptax's follow-on analysis showed the sample decrypted strings with PBEWithMD5AndDES, loaded code via getClassLoader and DexClassLoader, and reused a com.xjuys payload previously seen in other Joker samples.
Check Point reported a new Joker variant on Google Play that concealed its malicious DEX payload as Base64-encoded data inside the app, then decoded and dynamically loaded it to evade detection. The campaign used a Notification Listener service and C2-controlled activation to silently subscribe victims to premium services, and the researchers published multiple infected package names and hashes.
DNS metadata cited by CSIS TechBlog suggested that the Joker family's recent campaigns began in early June 2019.
K7 Labs states that the Joker malware family had been targeting Android users since it was discovered in 2017.
A Medium analysis examined the Android app Health Index Monitor, identifying it as a Joker-family sample that used Apache Cordova plus multiple dynamically loaded stages including a payload DEX, a remote JAR, and a fourth-stage DEX. The malware stole SMS content via notification-listener access, registered SMS receivers, exfiltrated data, and could retrieve accounts and send SMS messages.
K7 Labs stated that multiple recently discovered Joker-infected Google Play apps, including com.camera.phototimezonecamera and related packages, had been removed from the store.
K7 Labs analyzed a Joker sample in com.camera.phototimezonecamera that dynamically downloaded a first-stage JAR from grouplearn[.]shop and a second-stage JAR from implemente[.]life. The second payload supplied the missing okhttp3.service class and enabled SMS interception and premium-service subscription fraud.
Quick Heal reported that Google Play Store applications were again found carrying Joker malware, indicating continued recurrence of malicious Android apps in the Play ecosystem.
K7 Labs listed multiple Google Play packages tied to the Joker campaign, including com.upinklook.kunicam, kindledev.nap.ksms, com.camerasideas.collagemaker, and others, along with hashes, payload URLs, and final C2 IP addresses.
K7 Labs reported a new Google Play Joker campaign in which samples such as kindledev.nap.ksms used Tencent Legu or ijiami packers, unpacked at runtime, and downloaded malicious DEX payloads. The campaign continued Joker's SMS theft, contact theft, and premium-service fraud activity.
Trend Micro found two additional Joker-associated samples tied to surasuke7.github.io, though neither sample was available on Google Play.
Trend Micro analyzed a Joker sample embedded in a working wallpaper app that used a JavaScript bridge and GitHub-hosted infrastructure at surasuke7.github.io to help hide payload elements. The sample appeared to target a mobile operator in Thailand and subscribed users to a WAP service without their knowledge.
CSIS TechBlog said Google was removing the malicious Joker apps from Google Play during the researchers' investigation.
CSIS TechBlog reported Joker distributed through 24 Google Play apps with more than 472,000 installs. The malware used second-stage payloads to steal SMS messages, contacts, and device data while committing premium-subscription fraud.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 123 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
cryptax.medium.com
Open sourcecryptax.medium.com
Open sourcelabs.k7computing.com
Open sourceblogs.quickheal.com
Open sourcelabs.k7computing.com
Open sourceblogs.quickheal.com
Open sourcetrendmicro.com
Open sourceresearch.checkpoint.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several Android malware families, including **Joker**, **MobOk**, **Vesub**, and **GriftHorse**, were found fraudulently enrolling victims in paid mobile subscription services by abusing device permissions, intercepting SMS confirmation codes, and hiding billing steps inside deceptive app workflows. Researchers said the malware used techniques such as notification access, invisible webviews, fake login prompts, and anti-fraud evasion to complete sign-ups without clear user consent, turning infected phones into tools for recurring premium-service charges. The campaigns were distributed through multiple channels, including **Google Play**, unofficial app stores, preinstalled software, and trojanized popular applications. **Joker** operated as a staged downloader that could tamper with confirmation flows, **MobOk** added CAPTCHA bypass capabilities and was often linked to delivery by **Triada**, **Vesub** spread through fake apps from unofficial sources, and **GriftHorse** variants relied on misleading subscription pages and hidden recurring billing terms. Victim telemetry covering January 2021 through March 2022 showed **Russia** as the most affected country overall, with **MobOk** identified as the most prevalent family among the subscription trojans reviewed.
Aug 14, 2026
Researchers at Zimperium’s zLabs uncovered a large Android malware campaign that used nearly 250 malicious apps to silently subscribe victims to premium carrier-billing services and abuse premium SMS flows without consent. The apps impersonated well-known brands and games including **Facebook Messenger**, **Instagram Threads**, **TikTok**, **Minecraft**, and **Grand Theft Auto**, and targeted users in **Malaysia, Thailand, Romania, and Croatia**. The operation was active from March 2025 through January 2026, with some attacker infrastructure still online at the time of reporting. zLabs identified three malware variants that activated only when a device’s SIM matched specific mobile operators, helping the fraud remain hidden from non-targeted users by showing benign fallback pages. The malware used hidden WebViews and JavaScript to automate subscription pages, intercepted one-time passwords through Google’s SMS Retriever API, disabled Wi‑Fi to force cellular billing, stole cookies, sent delayed premium SMS messages, and reported activity through attacker-controlled Telegram channels. Researchers said the infrastructure supported command-and-control, victim tracking, analytics, and exfiltration of device metadata and billing-page content.
Jun 29, 2026
Multiple reports highlight evolving **Android** threats that abuse SMS/telephony access and advanced evasion to enable fraud, surveillance, and account takeover. CloudSEK described a shift from repackaged apps to **runtime manipulation** using the *LSPosed* framework, where a malicious module (e.g., **Digital Lutera**) hooks `SmsManager` and `TelephonyManager` to undermine India’s **UPI SIM-binding** controls. The technique can intercept registration tokens and 2FA, spoof device identity/phone number, and exfiltrate data to **Telegram**; it also uses **Socket.IO** for real-time C2 and can remotely inject fabricated SMS entries into the device’s “Sent” database to make bank backends believe a SIM is present on a different device, enabling scalable payment fraud and account takeover. Separately, Acronis TRU (reported by Hackread) identified a **fake Red Alert** rocket-warning app distributed via SMS lures impersonating Israel’s Home Front Command; the trojanized app displays legitimate alerts to reduce suspicion while requesting extensive permissions to steal **GPS location**, **SMS/OTP**, contacts, installed-app inventory, and on-device account details, then exfiltrates data to a remote server, including via **certificate spoofing** and UI tricks to appear Play Store-installed. Zimperium reported a new Android RAT, **SurxRAT**, that can download and run **LLM modules** from third-party repositories to automate phishing and social engineering and to interact with apps/UI for credential theft and data exfiltration, reinforcing the need for behavior-based mobile detection, tighter app controls, and stronger integrity enforcement (e.g., *Play Integrity API* with `MEETS_STRONG_INTEGRITY`) where applicable.
Jun 29, 2026