Loading story…
Trend Micro reported that an underground SMS phone-verified account (PVA) service is using infected Android devices to intercept selected text messages and resell them to customers for bulk account creation and related abuse. The malware is described as being under active development, with multiple DEX variants providing similar functionality while connecting to different command-and-control servers. Rather than harvesting all messages, the implants reportedly use C2-supplied regex patterns to capture only targeted SMS content, helping the operation stay covert while extracting verification codes.
The service enables customers to bypass platform defenses by pairing compromised phone numbers with residential proxies or VPNs that match the victim device's country, making fraudulent registrations appear legitimate. Researchers said the model weakens SMS-based verification at scale and supports fraud, anonymity, coordinated inauthentic behavior, and abuse of sign-on bonuses. They also warned that the same interception capability could be expanded beyond account verification to steal one-time passwords and support broader surveillance of victims.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The report cites a 2020 case involving a Russian car-sharing service and a fraudulent account allegedly created using a victim's name and disposable SIM cards as an example of the kind of abuse enabled by SMS PVA services.
Researchers documented a misuse case in which several malware samples used SMS PVA services to obtain phone numbers, link them to existing online payment service accounts, and then attempt purchases on an online shopping site.
Trend Micro researchers identified two additional DEX files with the same Android malware functionality but different command-and-control servers, indicating active development and multiple versions of the malware used by an SMS PVA service.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight evolving **Android** threats that abuse SMS/telephony access and advanced evasion to enable fraud, surveillance, and account takeover. CloudSEK described a shift from repackaged apps to **runtime manipulation** using the *LSPosed* framework, where a malicious module (e.g., **Digital Lutera**) hooks `SmsManager` and `TelephonyManager` to undermine India’s **UPI SIM-binding** controls. The technique can intercept registration tokens and 2FA, spoof device identity/phone number, and exfiltrate data to **Telegram**; it also uses **Socket.IO** for real-time C2 and can remotely inject fabricated SMS entries into the device’s “Sent” database to make bank backends believe a SIM is present on a different device, enabling scalable payment fraud and account takeover. Separately, Acronis TRU (reported by Hackread) identified a **fake Red Alert** rocket-warning app distributed via SMS lures impersonating Israel’s Home Front Command; the trojanized app displays legitimate alerts to reduce suspicion while requesting extensive permissions to steal **GPS location**, **SMS/OTP**, contacts, installed-app inventory, and on-device account details, then exfiltrates data to a remote server, including via **certificate spoofing** and UI tricks to appear Play Store-installed. Zimperium reported a new Android RAT, **SurxRAT**, that can download and run **LLM modules** from third-party repositories to automate phishing and social engineering and to interact with apps/UI for credential theft and data exfiltration, reinforcing the need for behavior-based mobile detection, tighter app controls, and stronger integrity enforcement (e.g., *Play Integrity API* with `MEETS_STRONG_INTEGRITY`) where applicable.
Jun 29, 2026
Researchers at Zimperium’s zLabs uncovered a large Android malware campaign that used nearly 250 malicious apps to silently subscribe victims to premium carrier-billing services and abuse premium SMS flows without consent. The apps impersonated well-known brands and games including **Facebook Messenger**, **Instagram Threads**, **TikTok**, **Minecraft**, and **Grand Theft Auto**, and targeted users in **Malaysia, Thailand, Romania, and Croatia**. The operation was active from March 2025 through January 2026, with some attacker infrastructure still online at the time of reporting. zLabs identified three malware variants that activated only when a device’s SIM matched specific mobile operators, helping the fraud remain hidden from non-targeted users by showing benign fallback pages. The malware used hidden WebViews and JavaScript to automate subscription pages, intercepted one-time passwords through Google’s SMS Retriever API, disabled Wi‑Fi to force cellular billing, stole cookies, sent delayed premium SMS messages, and reported activity through attacker-controlled Telegram channels. Researchers said the infrastructure supported command-and-control, victim tracking, analytics, and exfiltration of device metadata and billing-page content.
Jun 29, 2026
Group-IB reported a new stage in the evolution of Android **SMS-stealing malware** targeting users in Uzbekistan, indicating that threat actors are continuing to refine mobile malware operations aimed at intercepting text messages. Such malware is commonly used to capture one-time passwords, banking verification codes, and other sensitive communications that can enable account takeover, financial fraud, and unauthorized access to online services. The report indicates that the activity is part of a broader shift in mobile threat tactics, with attackers adapting their tooling and lures to improve infection success and persistence on Android devices. The campaign highlights ongoing risk to mobile users and organizations that rely on SMS-based authentication, underscoring the need for stronger mobile security controls, user awareness, and reduced dependence on SMS for high-risk authentication workflows.
Jul 12, 2026