Loading story…
Google disclosed that the Android potentially harmful application family Chamois operated as a large fraud botnet that targeted both users and Google's advertising ecosystem. The malware generated ad fraud through deceptive pop-up ads, promoted apps via background installations, carried out premium SMS fraud, and downloaded additional plugins, while relying on a four-stage payload, obfuscation, and encrypted storage to avoid detection. Google said it identified the activity through ad traffic quality analysis, blocked the apps with Verify Apps, and removed actors abusing its advertising platforms.
Separate reverse-engineering research showed that multiple Android malware families, including Chamois variants, used an anti-analysis native library dubbed WeddingCake to conceal malicious behavior and frustrate defenders. Packaged as an Android ELF shared object, the library decrypted hidden strings during JNI_OnLoad, dynamically registered native methods, and used a function identified as vxeg() to run more than 45 checks for emulators, instrumentation, the Monkey testing tool, CPU inconsistencies, and the Xposed Framework; if an analysis environment was detected, the app terminated with exit(0). The researcher reported finding WeddingCake in more than 5,000 unique Android APKs, underscoring how broadly the evasive component was deployed.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A Virus Bulletin 2018 paper by Maddie Stone analyzed an Android anti-analysis native library dubbed WeddingCake, which was used by multiple malware families including some Chamois variants. The paper reported WeddingCake in more than 5,000 unique Android APKs and detailed its JNI obfuscation, string decryption, and more than 45 anti-emulation and anti-instrumentation checks that terminate apps when analysis is detected.
Google said it implemented Verify Apps protections against Chamois and blocked the family to protect Android users. It also removed bad actors who were attempting to abuse Google's advertising systems.
On the Android Developers Blog, Google disclosed Chamois as a newly identified Android potentially harmful application family involved in ad fraud, background app installs, premium SMS fraud, and plugin downloads. Google said it had detected Chamois during ad traffic quality evaluation and described it as one of the largest Android PHA families seen on Android.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
virusbulletin.com
Open sourceandroid-developers.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied multiple Android threats to the **Ztorg** malware family, including trojanized apps such as **"Cool Video Player," "Magic browser,"** and **"Noise Detector"**. The malware used anti-analysis checks to avoid Android SDK emulators and common sandbox environments, then contacted command-and-control servers including `bbs.tihalf.com` and `alla.tihalf.com` with encrypted device data. In one infection chain, the app decrypted server responses, downloaded a secondary APK, decoded it, stored it as `dba.jar`, and loaded it invisibly with `DexClassLoader`, confirming a staged delivery model designed to hide malicious behavior from users and analysts. Separate Ztorg-linked samples distributed through Google Play were installed more than **60,000** times before removal and shifted monetization from rooting toward **premium SMS fraud** and likely **WAP billing abuse**, using IMSI-derived carrier data to tailor activity by country and operator. Other Ztorg payloads went further by lowering **SELinux** protections, attempting to root devices, replacing system binaries such as `/system/bin/debuggerd`, and silently installing additional apps and executables for persistence. Analysts said the family combined obfuscation, encrypted payload delivery, rooting components, and stealthy monetization modules, making infections difficult to detect and remove.
Aug 15, 2026
The **Joker** Android malware repeatedly infiltrated **Google Play** through seemingly legitimate apps, where it used multistage payload delivery, dynamic code loading, and heavy obfuscation to evade review while stealing **SMS messages**, **contacts**, device data, and notification content. Researchers tied campaigns across dozens of apps and hundreds of thousands of installs, including trojanized utility, wallpaper, camera, and medical-themed applications. Multiple reports showed Joker hiding malicious logic in ad frameworks, splash-screen code, packed APKs, Apache Cordova components, and runtime-loaded `.dex` or `.jar` files, with some samples using **DexClassLoader**, **JavaScript-to-Java bridges**, and notification-listener abuse to capture one-time PINs and SMS content without directly requesting sensitive permissions. The malware’s primary objective was **premium-service fraud**: it identified victims by SIM or mobile country code, selectively targeted users in specific countries, intercepted verification messages, and silently enrolled devices in **premium WAP** or **premium SMS** subscriptions. Analysts observed infrastructure hosted on domains and cloud storage including **Aliyun OSS**, as well as payload concealment through **GitHub-hosted** resources, while newer variants unpacked themselves at runtime with commercial packers and fetched additional stages from remote servers before activating classes absent from the original APK. Google removed identified malicious apps from the Play Store, but the reporting showed Joker remained active for years and continuously adapted its delivery and evasion techniques to sustain mobile fraud operations.
Aug 15, 2026
Researchers reported a large Android supply-chain compromise in which devices from more than 50 brands were shipped with malware embedded in firmware, allowing attackers to control phones before users installed any apps. Trend Micro said the operation, attributed to **Lemon Group**, implanted **Guerrilla** malware through a tampered zygote-related library and used a core plugin called **Sloth** to fetch modules for SMS interception, proxying, cookie theft, WhatsApp abuse, ad fraud, and silent app installation. Telemetry and actor-hosted data indicated activity across more than 180 countries, hundreds of thousands of mobile numbers used for OTP requests, and millions of potentially affected devices, with the business later rebranded in part from Lemon SMS to Durian Cloud SMS while keeping backend infrastructure. The findings echo earlier reporting on **Triada**, an Android malware family that evolved from a rooting trojan into a preinstalled system-image backdoor embedded in framework components. Google previously said Triada abused privileged contexts such as **System UI** and **Google Play** to execute code, monitor foreground apps, replace ads, and install applications so they appeared to come from Google Play, and that infections were inserted into device images during production by a third party using the names **Yehuo** or **Blazefire**. Trend Micro said the newer Guerrilla campaign showed infrastructure overlap with Triada operators, suggesting a continuing ecosystem of firmware-level Android compromise monetized through fraud, silent installs, and persistent device backdoors.
Aug 21, 2026