Android Subscription Trojans Abuse SMS and Hidden Billing Flows

Several Android malware families, including Joker, MobOk, Vesub, and GriftHorse, were found fraudulently enrolling victims in paid mobile subscription services by abusing device permissions, intercepting SMS confirmation codes, and hiding billing steps inside deceptive app workflows. Researchers said the malware used techniques such as notification access, invisible webviews, fake login prompts, and anti-fraud evasion to complete sign-ups without clear user consent, turning infected phones into tools for recurring premium-service charges.

The campaigns were distributed through multiple channels, including Google Play, unofficial app stores, preinstalled software, and trojanized popular applications. Joker operated as a staged downloader that could tamper with confirmation flows, MobOk added CAPTCHA bypass capabilities and was often linked to delivery by Triada, Vesub spread through fake apps from unofficial sources, and GriftHorse variants relied on misleading subscription pages and hidden recurring billing terms. Victim telemetry covering January 2021 through March 2022 showed Russia as the most affected country overall, with MobOk identified as the most prevalent family among the subscription trojans reviewed.