zLabs uncovered a 10-month Android campaign that used nearly 250 malicious apps to conduct carrier billing fraud and premium SMS abuse across Malaysia, Thailand, Romania, and Croatia. The operation impersonated popular apps and brands, used WebView automation, OTP interception, and Telegram reporting, and remains partially active with several infrastructure domains still operational. #Facebook #Instagram #TikTok #Minecraft #GTA #Telegram #DiGi #Celcom #Maxis #U Mobile #TrueMove H #A1 #Telemach #Vodafone #Orange #Telekom
Keypoints
- zLabs identified a sophisticated Android fraud campaign involving almost 250 malicious apps.
- The campaign targeted users in Malaysia, Thailand, Romania, and Croatia based on mobile operator validation.
- Victims were silently subscribed to premium services through carrier billing fraud and premium SMS abuse.
- The malware impersonated popular apps and games such as Facebook, Instagram, TikTok, Minecraft, and GTA to lure installations.
- Three malware variants were found, ranging from automated subscription workflows to cookie theft and real-time Telegram reporting.
- The malware used WebView manipulation, JavaScript injection, SMS Retriever API abuse, delayed SMS sending, and WiFi disabling to improve success and evade detection.
- Attackers relied on a distributed infrastructure of domains for command and control, tracking, analytics, and exfiltration.
MITRE Techniques
- [T1476 ] Deliver Malicious App via Other means – Malicious apps were distributed through social media and search engines while masquerading as legitimate software (‘Malicious applications distributed through social media platforms (Facebook, TikTok) and search engines (google) masquerading as legitimate’).
- [T1603 ] Scheduled Task/Job – The malware scheduled SMS fraud actions at delayed intervals to evade detection (‘It schedules delayed messages at 60 seconds and 90 seconds after the initial burst’).
- [T1628.001 ] Hide Artifacts: User Evasion – On non-targeted operators, it displayed benign web content to avoid suspicion (‘When non-targeted operators are detected, displays legitimate content … to avoid suspicion’).
- [T1422 ] System Network Configuration Discovery – It checked SIM operator codes to determine whether the device belonged to a targeted carrier (‘checks SIM operator codes … to identify mobile carrier and determine whether victim should be targeted’).
- [T1426 ] System Information Discovery – It collected device metadata such as device ID, model, OS version, IP address, and user agent for tracking (‘Collects device metadata including device ID, model, operating system version, IP address, and user agent’).
- [T1412 ] Capture SMS Messages – It used the Google SMS Retriever API to automatically capture OTP messages for billing confirmation (‘abuse of Google’s SMS Retriever API to intercept carrier billing confirmation codes’).
- [T1417 ] Input Capture – It captured HTML source from loaded webpages and carrier billing portals to monitor and optimize the attack (‘captures the HTML source of every page loaded in the background and sends it to the attackers’ server’).
- [T1437.001 ] Application Layer Protocol: Web Protocols – It communicated with C2 infrastructure over HTTPS to fetch targets and send reports (‘Communicates with C2 servers via HTTPS to fetch dynamic subscription targets’).
- [T1646 ] Exfiltration Over C2 Channel – It exfiltrated metadata, HTML source, subscription status, and tracking data to attacker servers (‘Exfiltrates device metadata, HTML source code, subscription status, and tracking data’).
- [T1643 ] Carrier Billing Fraud – The malware subscribed victims to premium services without consent using WebView manipulation, JavaScript injection, OTP interception, and direct SMS sending (‘Subscribes victims to premium SMS services without consent’).
- [T1582 ] SMS Control – It sent unauthorized premium SMS messages, disabled WiFi to force cellular connectivity, and scheduled delayed messages (‘Sends unauthorized premium SMS messages to short codes’).
Indicators of Compromise
- [Domain ] Command and control, tracking, billing, and exfiltration infrastructure – apizep.mwmze[.]com, modobomz[.]com, api.modobomco[.]com
- [Domain ] Victim tracking and referrer validation endpoints – onesignalmdb.modobomz[.]com, onesignal.mwmze[.]com
- [Short code / premium SMS destination ] Premium SMS fraud destinations used in Malaysia, Romania, and Croatia – +33293, +32133, 32128, 866866, +1280
- [Keyword ] Trigger strings for premium subscription actions – ON HITZ, ON GAM1, ON A3, GYGO
- [URL / web resource ] Benign fallback and billing portal activity – apkafa[.]com, DiGi carrier billing portal
- [Telegram channel / API ] Real-time victim reporting and action notifications – private Telegram channel, Telegram Bot API