According to Zimperium zLabs, the new malware has been embedded in at least 200 malicious applications, many of which have managed to circumvent the protections offered by the Google Play Store, the official repository for Android apps. 
The researchers say that the operators behind the Trojan have managed to infect so many devices that a stable cash flow of illicit funds, “generating millions in recurring revenue each month,” has been established. 
Believed to have been in operation since November 2020, the “GriftHorse” campaign relies on victims being duped into handing over their phone number, which is then used to subscribe them to premium SMS messaging services.  Victims first download Android apps that appear innocent and legitimate. These apps vary from puzzle games and utilities to dating software, food and drink, with the most popular malicious app – a translator – accounting for at least 500,000 downloads.  Upon installation, however, the GriftHorse Trojan, written in Apache Cordova, constantly bombards the user with messages, alerting them to a fake prize they have won and then redirecting them to a website page based on their geolocation, and, therefore, their language.  Mobile users are then asked to submit their phone numbers for verification purposes. If they submit this information, they are then subscribed to premium services “without their knowledge and consent,” zLabs noted.
Some of the charges are upward of €30 ($35) per month, and if a victim does not notice this suspicious transaction, then they could, theoretically, be charged for months on end with little hope of ever clawing back their cash. 
In order to avoid discovery, the malware’s operators use changeable URLs rather than hardcoded addresses. 
“This method allowed the attackers to target different countries in different ways,” the team says. “This check on the server-side evades dynamic analysis checking for network communication and behaviors.”
zLabs reported its findings to Google who promptly removed the Android apps marked as malicious from Google Play. However, these apps are still available on third-party platforms. 

This banking Trojan abuses YouTube to manage remote settingsObliqueRAT Trojan now lurks in images on compromised websitesMeet Janeleiro: a new banking Trojan striking company, government targets

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0