Chinese Taomike Monetization Library Steals SMS Messages
Summary: Palo Alto Networks' WildFire has captured over 18,000 Android apps containing a newer version of the Chinese Taomike monetization SDK, released around August 2015, that copies every SMS message received on the phone and uploads it to the IP address 112.126.69.51, which belongs to Taomike's API server. The library, called "zdtpay," registers a receiver for SMS_RECEIVED and BOOT_COMPLETED, and the affected apps are distributed through third-party channels in China rather than Google Play.
Bottom line: The library captures all messages, not just those tied to Taomike's payment platform, and Unit 42 says it does not know how Taomike is using the stolen messages - so every text on an affected device, including any second-factor or verification code, has left the phone.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026