Loading story…
Researchers identified Fleckpe, an Android subscription Trojan distributed through 11 malicious apps on Google Play that masqueraded as photo editors, wallpaper tools, and similar utilities. Before Google removed the apps, they had accumulated more than 620,000 installs. The malware has reportedly been active since 2022 and was designed to monetize infections by silently enrolling victims in premium mobile services without their knowledge.
Fleckpe used a malicious dropper and a heavily obfuscated native library to decrypt and run its payload, then contacted command-and-control infrastructure and opened subscription pages in an invisible browser window. It also abused notification access to intercept confirmation messages and complete the sign-up flow automatically. Analysis indicated a particular focus on Thailand, based on hard-coded Thai MCC/MNC values and Thai-language reviews, although infections were also observed in Poland, Malaysia, Indonesia, and Singapore. Newer variants shifted more subscription logic into native code to complicate analysis and evade detection.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Kaspersky published a report detailing Fleckpe's use of an obfuscated native library, a malicious dropper, invisible browser-based subscription fraud, notification interception, and associated command-and-control domains and hashes.
Kaspersky reported that the Fleckpe Android subscription Trojan had likely been active since 2022, distributed through malicious Google Play apps disguised as utilities such as photo editors and wallpaper apps.
By the time of Kaspersky's report, all 11 identified Fleckpe-infected apps had been removed from Google Play. The report noted that additional undiscovered infected apps may also have existed.
Kaspersky identified 11 Google Play apps infected with Fleckpe that had accumulated more than 620,000 installs. The campaign particularly targeted Thailand, with additional victims observed in Poland, Malaysia, Indonesia, and Singapore.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 86 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several Android malware families, including **Joker**, **MobOk**, **Vesub**, and **GriftHorse**, were found fraudulently enrolling victims in paid mobile subscription services by abusing device permissions, intercepting SMS confirmation codes, and hiding billing steps inside deceptive app workflows. Researchers said the malware used techniques such as notification access, invisible webviews, fake login prompts, and anti-fraud evasion to complete sign-ups without clear user consent, turning infected phones into tools for recurring premium-service charges. The campaigns were distributed through multiple channels, including **Google Play**, unofficial app stores, preinstalled software, and trojanized popular applications. **Joker** operated as a staged downloader that could tamper with confirmation flows, **MobOk** added CAPTCHA bypass capabilities and was often linked to delivery by **Triada**, **Vesub** spread through fake apps from unofficial sources, and **GriftHorse** variants relied on misleading subscription pages and hidden recurring billing terms. Victim telemetry covering January 2021 through March 2022 showed **Russia** as the most affected country overall, with **MobOk** identified as the most prevalent family among the subscription trojans reviewed.
Aug 14, 2026
Researchers at Zimperium’s zLabs uncovered a large Android malware campaign that used nearly 250 malicious apps to silently subscribe victims to premium carrier-billing services and abuse premium SMS flows without consent. The apps impersonated well-known brands and games including **Facebook Messenger**, **Instagram Threads**, **TikTok**, **Minecraft**, and **Grand Theft Auto**, and targeted users in **Malaysia, Thailand, Romania, and Croatia**. The operation was active from March 2025 through January 2026, with some attacker infrastructure still online at the time of reporting. zLabs identified three malware variants that activated only when a device’s SIM matched specific mobile operators, helping the fraud remain hidden from non-targeted users by showing benign fallback pages. The malware used hidden WebViews and JavaScript to automate subscription pages, intercepted one-time passwords through Google’s SMS Retriever API, disabled Wi‑Fi to force cellular billing, stole cookies, sent delayed premium SMS messages, and reported activity through attacker-controlled Telegram channels. Researchers said the infrastructure supported command-and-control, victim tracking, analytics, and exfiltration of device metadata and billing-page content.
Jun 29, 2026
The **Joker** Android malware repeatedly infiltrated **Google Play** through seemingly legitimate apps, where it used multistage payload delivery, dynamic code loading, and heavy obfuscation to evade review while stealing **SMS messages**, **contacts**, device data, and notification content. Researchers tied campaigns across dozens of apps and hundreds of thousands of installs, including trojanized utility, wallpaper, camera, and medical-themed applications. Multiple reports showed Joker hiding malicious logic in ad frameworks, splash-screen code, packed APKs, Apache Cordova components, and runtime-loaded `.dex` or `.jar` files, with some samples using **DexClassLoader**, **JavaScript-to-Java bridges**, and notification-listener abuse to capture one-time PINs and SMS content without directly requesting sensitive permissions. The malware’s primary objective was **premium-service fraud**: it identified victims by SIM or mobile country code, selectively targeted users in specific countries, intercepted verification messages, and silently enrolled devices in **premium WAP** or **premium SMS** subscriptions. Analysts observed infrastructure hosted on domains and cloud storage including **Aliyun OSS**, as well as payload concealment through **GitHub-hosted** resources, while newer variants unpacked themselves at runtime with commercial packers and fetched additional stages from remote servers before activating classes absent from the original APK. Google removed identified malicious apps from the Play Store, but the reporting showed Joker remained active for years and continuously adapted its delivery and evasion techniques to sustain mobile fraud operations.
Aug 15, 2026