Android Malware Campaign Uses 250 Fake Apps for Silent Carrier Billing Fraud (infosecurity-magazine.com)

• Nearly 250 fake Android apps used in 10-month campaign
• Targets in Malaysia, Thailand, Romania, Croatia
• OTP interception via Google SMS Retriever API
• Three malware variants with increasing sophistication
• C2 infrastructure partially still online

"The 'Premium Deception' campaign used nearly 250 counterfeit Android apps from March 2025 to mid-January 2026 to silently enroll victims in premium SMS services in Malaysia, Thailand, Romania, and Croatia. Three variants were identified, including sophisticated OTP interception via the Google SMS Retriever API and automated billing via hidden WebViews. Infrastructure remains partially online."