This campaign consists of approximately 250 Android malware applications that perform carrier billing fraud by silently subscribing victims to premium SMS services without consent. The malware selectively targets users by validating their SIM operator, automates subscription workflows using WebView and JavaScript injection, intercepts one-time passwords by abusing Google's SMS Retriever API, and exfiltrates device metadata through Telegram channels. It impersonates well-known apps such as Facebook, Instagram, TikTok, Minecraft, and Grand Theft Auto to lure victims. The campaign has three variants with escalating sophistication and uses distributed command and control infrastructure. It primarily affects users in Malaysia, Thailand, Romania, and Croatia and was active from March 2025 to January 2026.

Victims may incur unauthorized charges on their mobile carrier bills due to silent subscriptions to premium services. The malware's ability to intercept OTPs and exfiltrate device metadata increases the risk of further compromise and privacy violations. The regional targeting limits impact to users of specific mobile operators in the affected countries. No known exploits in the wild have been reported beyond this campaign. The campaign's impersonation of popular apps increases the likelihood of user infection.

No official patch or remediation is available as this is a malware campaign rather than a software vulnerability. Mitigation involves user education to avoid installing apps from untrusted sources, verifying app legitimacy, and monitoring mobile carrier bills for unauthorized charges. Mobile operators and security vendors should monitor and block the identified malicious domains and command and control infrastructure. Users should be cautious of apps requesting SMS permissions and consider using security solutions that detect premium SMS fraud. Check vendor advisories or security providers for updated detection and removal tools.