Large-scale Android carrier-billing fraud campaign leveraging fake apps and hidden WebView automation
Summary
Hide ▲
Show ▼
A 10-month Android malware campaign used nearly 250 counterfeit apps to enroll victims in premium services via carrier billing, targeting users in Malaysia, Thailand, Romania and Croatia. The operation, codenamed Premium Deception by Zimperium zLabs, ran from March 2025 to mid-January 2026 and maintained portions of its infrastructure online at the time of disclosure. Malware variants automated end-to-end subscription enrollment by exploiting legitimate Android APIs, hidden WebViews and operator-specific billing portals to bypass user interaction and detection.
Timeline
-
20.05.2026 18:30 1 articles · 3h ago
Premium Deception campaign uncovered: end-to-end carrier-billing fraud using hidden WebView automation across four countries
Researchers identified a 10-month Android carrier-billing fraud campaign using ~250 fake apps to enroll victims in premium services via mobile billing. The operation automated subscription workflows by disabling Wi-Fi, loading operator portals in hidden WebViews, executing JavaScript to click billing buttons and harvesting OTPs via Google’s SMS Retriever API. Three malware variants were deployed: a fully automated variant in Malaysia; a dynamic, C2-controlled variant in Thailand with delayed SMS scheduling and cookie harvesting; and a Telegram-reporting variant that relayed real-time infection and event data. Infrastructure analysis links the campaign to a commercial operation with referrer-tagged payloads, fallback benign webviews for non-target SIMs and C2 domains modobomz[.]com and mwmze[.]com.
Show sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
Information Snippets
-
Campaign duration spanned March 2025 to mid-January 2026, with active infrastructure observed at publication.
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
-
Malware variants targeted users in Malaysia (DiGi), Thailand, Romania and Croatia using carrier billing portals and premium SMS short codes.
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
-
The most advanced variant, deployed against Malaysian DiGi subscribers, automated subscription enrollment by disabling Wi-Fi, loading DiGi’s billing portal in a hidden WebView, clicking "Request TAC" via JavaScript, and confirming subscriptions using OTPs retrieved via Google’s SMS Retriever API.
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
-
A second variant targeted Thai users with dynamic C2-driven payloads, delayed SMS scheduling (60s and 90s intervals) to evade fraud detection, and cookie harvesting from carrier pages.
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
-
A third variant added real-time Telegram reporting for infection status, permission grants and premium SMS transmission events.
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
-
Each sample embedded a structured HTTP referrer header to attribute infections to specific fake personas and distribution channels (TikTok, Facebook, Google).
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
-
Fallback behavior on non-target SIMs displayed a benign webview at apkafa.com to maintain persistence, mapped to MITRE ATT&CK technique T1628.001.
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30
-
C2 infrastructure used modobomz[.]com and mwmze[.]com domains; at least 12 premium SMS short codes were abused across the four countries.
First reported: 20.05.2026 18:301 source, 1 articleShow sources
- Android Malware Campaign Used Hundreds of Fake Apps to Silently Charge Users — www.infosecurity-magazine.com — 20.05.2026 18:30