Financial Fraud APK Campaign
Summary: Unit 42 documented a family of malicious Android APK files targeting Chinese users that impersonate law enforcement, claim the victim's phone number or bank account is tied to financial fraud, and prompt them to enter payment card details so attackers can drain the account. Indicators appeared as early as November 2022, delivery attempts surged to a peak of 717 in September 2023, and the app - installed as "安全防护" ("Security Protection") - requests CALL_PHONE and RECEIVE_SMS permissions to block incoming calls and texts.
What's compelling: The app blocks incoming calls and SMS so victims cannot receive fraud alerts from banks or legitimate law enforcement while the account is being drained, and because it is distributed outside Google Play, it never passes official store review.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026