# Android Malware Campaign Exploits Carrier Billing to Defraud Users Across Asia and Eastern Europe


A financially motivated threat actor has launched a sophisticated, long-running campaign targeting Android users with malware that silently enrolls victims in expensive premium services billed directly to their mobile carriers. Security researchers at Zimperium have identified nearly 250 malicious applications distributed across Malaysia, Thailand, Romania, and Croatia, each meticulously tailored to exploit regional carrier billing systems and specific mobile operator vulnerabilities.


## The Threat


The campaign represents a particularly insidious form of mobile fraud: rather than stealing banking credentials or demanding ransoms, the attackers have built a distributed malware ecosystem designed to generate revenue through subscription fraud at scale. By disguising malware as trusted applications like Facebook Messenger, TikTok, Minecraft, and Grand Theft Auto, the threat actors have created a low-friction infection vector that exploits user trust in familiar application names.


What makes this campaign particularly dangerous:


  • Geotargeted precision: The malware selectively activates based on the victim's mobile carrier, reducing detection risk by avoiding suspicious behavior on non-targeted devices
  • Silent operation: The entire fraud workflow occurs without user interaction through automated WebView manipulation
  • OTP circumvention: The malware intercepts one-time passwords to complete subscription workflows that normally require explicit user confirmation
  • Long operational runway: The campaign has been active for over 10 months with infrastructure remaining operational, suggesting sustained financial success

    • ## Campaign Timeline and Geographic Scope


    Zimperium's research timeline reveals a campaign that began in March 2025 and remained highly active through at least January 2026. The geographic distribution is strategic: targeting emerging markets where carrier billing remains a primary payment method and where billing disputes may take longer to resolve.


    | Region | Targeted Carriers | Known Apps | Status |

    |--------|------------------|-----------|--------|

    | Malaysia | DiGi, Celcom, Maxis, U Mobile | 100+ variants | Highly Active |

    | Thailand | Regional operators | 80+ variants | Active |

    | Romania | Local carriers | 40+ variants | Active |

    | Croatia | Regional operators | 30+ variants | Active |


    The malware distribution infrastructure suggests the threat actor has developed a sophisticated supply chain, likely distributing these apps through unofficial app stores, social engineering campaigns, or compromised third-party distribution channels targeting users who may be less familiar with app store security controls.


    ## Technical Architecture and Attack Flow


    Zimperium identified three distinct malware variants, each demonstrating escalating technical sophistication. The most advanced variant—targeting Malaysian users—represents a fully automated attack chain that eliminates every user interaction requirement.


    ### Attack Execution Flow:


    1. Device Profiling: Upon installation, the malware reads the device's SIM card information to identify the mobile operator

    2. Carrier Matching: The malware cross-references the identified carrier against a hardcoded list of targets

    3. Conditional Activation: If the carrier matches a target, the malware proceeds with fraud workflow; otherwise, it displays an innocuous webpage to avoid triggering security tools

    4. WebView Automation: The malware uses WebView automation to navigate carrier billing portals programmatically

    5. JavaScript Injection: Malicious JavaScript is injected into the billing pages to interact with form elements, enter subscription details, and submit payment requests

    6. OTP Interception: When the carrier billing system requests a one-time password confirmation, the malware intercepts this OTP (likely through accessibility service permissions or notification monitoring) and automatically submits it

    7. Subscription Completion: The premium service subscription is finalized and billed directly to the victim's carrier account


    The technical sophistication varies by variant. The Romanian and Croatian variants require some user interaction, while the Malaysian variant achieves near-complete automation—a design choice that suggests the threat actor has invested in understanding and exploiting specific carrier billing implementations across different operators.


    ## Evasion and Persistence Mechanisms


    The malware employs multiple evasion techniques designed specifically to avoid mobile security detection:


  • Conditional Behavior: The malware only activates malicious functionality if the SIM card belongs to a targeted carrier, rendering the app inert on non-targeted devices and preventing security researchers from detecting anomalies during testing
  • Benign Appearance: When carrier targeting fails, the app displays legitimate content, making it appear to function normally if analyzed in generic testing environments
  • Permissions Abuse: The malware likely requests accessibility services, device administrator permissions, or notification access—permissions commonly granted by users for legitimate applications
  • Infrastructure Obfuscation: The campaign's persistence through January 2026 suggests either distributed infrastructure or regularly updated command-and-control communications

    • ## Implications for Mobile Security


    This campaign demonstrates a critical vulnerability in mobile carrier billing systems: the assumption that users will manually review and confirm subscription charges. By automating the entire workflow and intercepting OTP confirmations, the malware neutralizes the primary security control that protects users from unauthorized billing.


    ### Organizations at Risk:


  • Mobile operators: Carriers in targeted regions face revenue fraud, disputed billing claims, and potential regulatory action
  • End users: Individuals in affected countries risk expensive unauthorized subscriptions that may persist undetected for weeks
  • Third-party app stores: The distribution vector suggests unofficial app stores or compromised distribution channels may be participating in the scheme
  • Legitimate app developers: Impersonated brands (Messenger, TikTok, Minecraft, GTA) face reputation damage and user trust erosion

    • ## Recommendations


    ### For Mobile Operators:


  • Implement stricter OTP controls: Require additional verification steps for premium subscription activation beyond standard OTP flows
  • Rate-limit billing requests: Deploy anomaly detection to flag multiple rapid subscription requests from the same device or IP address
  • Enhance carrier verification: Require secondary confirmation mechanisms for premium service activation, particularly for low-value initial subscriptions
  • Monitor WebView activity: Implement carrier portal defenses that detect automated WebView interaction patterns

    • ### For End Users:


  • Download apps exclusively from official stores: Use only Google Play or official app store clients; avoid third-party or unofficial distribution channels
  • Review subscription settings: Regularly audit active subscriptions in carrier billing portals and device payment settings
  • Monitor carrier bills: Review mobile invoices monthly for unexpected charges or premium service subscriptions
  • Restrict sensitive permissions: Grant accessibility services and device administrator permissions only to trusted applications; verify the app's legitimate need for these permissions
  • Enable Google Play Protect: Ensure Google Play Protect is enabled for continuous malware scanning

    • ### For Enterprise and Security Teams:


  • Inventory mobile device usage: Identify employees in affected countries and validate their app installation practices
  • Deploy mobile threat defense: Organizations managing employee devices in Malaysia, Thailand, Romania, or Croatia should implement mobile threat defense solutions that detect WebView automation and OTP interception
  • Educate users: Conduct security awareness training highlighting the risks of unofficial app stores and the importance of verifying app legitimacy before installation

    • ---


    ## HackWire Analysis


    This campaign exposes a critical gap in mobile security architecture that has been underestimated by the industry: carrier billing systems remain fundamentally less protected than traditional payment methods, and threat actors have weaponized this weakness with remarkable precision.


    The most telling detail isn't the malware's technical sophistication—it's the threat actor's geographic and carrier-specific targeting. This isn't opportunistic malware; this is a business. The attacker has invested in understanding each regional carrier's billing portal, OTP implementation, and subscription workflow. They've built variants optimized for different carriers. They've maintained infrastructure for 10+ months. This is a revenue stream generating enough money to justify sustained development and operational costs.


    What's particularly concerning is the invisibility of this threat to most security discussions. While the industry obsesses over ransomware and nation-state actors, carriers in four countries have been silently bleeding revenue through subscription fraud for over a year. The victims—individual users in emerging markets—likely notice unexpected $5-15 charges on their carrier bills, dispute them as billing errors, and move on. Aggregated across thousands of devices, this becomes a multi-million dollar fraud operation flying under the radar of major security vendors and threat intelligence networks.


    The broader pattern is worth noting: carrier billing fraud is resurging as a profitable attack vector precisely because it's orthogonal to traditional security controls. Banks invest heavily in payment security. App stores deploy malware detection. But carrier billing portals? They're optimized for conversion, not security. They assume users are actively consenting. They assume OTPs are a sufficient verification mechanism. This campaign proves both assumptions are exploitable.


    The real question isn't whether this will be fixed—Zimperium's research will prompt carrier patches and Google Play will remove these apps. The question is how many similar, undetected campaigns are operating in other regions against other carriers using this same playbook. Until carriers fundamentally redesign their billing confirmation workflows to be resistant to automation and OTP interception, this threat will persist. — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Mobile Security](https://www.hackwire.news/category/mobile-security) and [Fraud](https://www.hackwire.news/category/breaches)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)