Premium Deception: Inside the 250+ Fake Android Apps That Stole Millions via Carrier Billing

Summary
A sustained 10‑month Android malware campaign used nearly 250 counterfeit apps impersonating TikTok, Facebook Messenger, Minecraft and Grand Theft Auto to silently enroll victims in premium subscription services. By reading SIM‑card information and validating the target mobile operator, the malware—dubbed “Premium Deception” by Zimperium zLabs—activated only for specific carriers in Malaysia, Thailand, Romania and Croatia. It automated the entire subscription workflow, employing WebView manipulation, JavaScript injection, abuse of Google’s SMS Retriever API, and even real‑time Telegram reporting. The operation was first detected in March 2025 and remained active through January 2026; although no malicious apps were found in the Google Play Store, experts warn that the attack reflects deep security gaps in legitimate distribution channels.

The Campaign

A new malware scam is silently executing billing fraud, targeting users based on their phone carriers and locations. Uncovered by cybersecurity group Zimperium, the campaign used nearly 250 Android applications to impersonate popular games and social media sites, including TikTok, Minecraft, Grand Theft Auto, Instagram Threads, and Facebook Messenger. Once downloaded, they charged unsuspecting users premium fees, enlisting them in automated subscription engines.

The scheme utilized advanced techniques like JavaScript injection, one-time password interception, and WebView automation to evade notice, automate subscriptions, track scams, and exfiltrate data. Deployed in Malaysia, Romania, Thailand, and Croatia, the malware read victims’ SIM cards and activated only for specific carriers. Zimperium first detected the scam in March 2025, tracking it until at least January 2026.

Google is adamant that none of the 250 malicious apps were available on its app store, according to Dark Reading. A Google spokesperson went on to say, “Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.” Despite these claims, however, experts argue that the attack is indicative of wide-reaching marketplace security challenges.

Three Malware Variants

Hackers used three malware variants to attack users. The first deployed an “automated subscription engine” to enlist victims in premium subscriptions without their knowledge. The most sophisticated of the three, the downloaded malware reads the device’s SIM card in order to attack hardcoded operators, such as Malaysia’s DiGi. To avoid detection, the apps showed harmless webpages if the victim was not part of specified carrier networks. If victims were part of a hardcoded billing network, however, the malware deployed a “clever social engineering tactic” to trick users into believing they were authenticating a gaming account.

The app then abused Google’s SMS Retriever API to intercept passwords before deploying JavaScript commands to hidden web pages to subscribe to premium content via the carrier’s billing portal. A second variant targeted users in Thailand through premium SMS messages that subscribed them to premium services. Using a multi-stage system to avoid detection, the malware was identified by Zimperium as showing users seemingly legitimate webpages while “the malware secretly loads hidden WebViews in the background to access additional carrier billing portals”.

According to Zimperium, attackers deploying this malware variant also utilized an “advanced cookie-stealing technique” to “maintain authenticated sessions with the carrier’s billing system.” A third version of the scheme “combines the SMS fraud capabilities of previous variants with instant notification to attackers via Telegram, giving them real-time visibility into successful infections”.

---

Targeting: Countries & Carriers

The scheme was highly specific in its target choices. Over half of the scammers’ victims were using Malaysian SIM cards. Users in Thailand and Romania each constituted roughly 15% of the scam’s attacks, while Croatia saw 1% of the operation’s activities. Within these four jurisdictions, at least 10 carriers were targeted by the malware scheme. In order of their prevalence, the list includes DiGi, Maxis, Celcom, U Mobile, Telekom, AIS, Orange, Vodafone, TrueMove H, and dtac TriNet.

According to Zimperium, the campaign was first detected in March 2025 and remained active through the second week of January 2026, representing approximately 10 months of sustained fraudulent operations. As of publication, portions of the infrastructure remain operational.

Defense & Protection

To mitigate threats like this, users should take the following steps:

1. Only download apps from official stores – Google Play Store, Samsung Galaxy Store, etc. While not immune, official stores have security screening that third‑party marketplaces lack.

2. Review recent mobile bills – Look for unexplained premium SMS charges or recurring subscription fees.

3. Audit installed apps – Remove any app that appears suspicious or that you don’t remember downloading. Cross‑check trusted brand names (e.g., “Facebook Messenger” vs. “Facebok Messanger”).

4. Keep Google Play Protect enabled – It runs automatically on most Android devices and can block known malware.

5. Avoid sideloading apps – Installing APKs from unknown sources is a common infection vector for these campaigns.

6. Check Zimperium’s GitHub repository – The firm has published indicators of compromise (IOCs) that users and admins can use to scan for infection.

Conclusion

The “Premium Deception” campaign is a clear example of how far malware developers have evolved their evasion and monetization tactics. By combining SIM‑based geo‑fencing, abuse of legitimate platform APIs, and real‑time performance tracking, the attackers were able to run a low‑noise, highly profitable operation for nearly a year. While Google’s own store was not directly compromised, the incident underscores the persistent risk of sideloaded apps and the need for constant vigilance by both users and security teams.