SMS-Based In-App Purchase on Android Is Not Worth The Risk
Summary: Palo Alto Networks WildFire found eight SMS-based in-app purchase SDKs on Android that silently send, receive, and block SMS in the background, including blocking messages by hard-coded or cloud-fetched policies. The SDKs appeared in at least 25 games across the JoloPlay and Wanyx app markets, with 17 of JoloPlay's top 50 games installed more than 1.7 million times, and all targeted Chinese users.
Bottom line: Installing one of these games is nearly equivalent to handing an app full SMS manager rights, and as of June 4, 2014, more than 86% of Android users ran versions below 4.4 that lack the default-SMS-app restriction.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026