Some attack vectors Spamhaus is observing in early 2021

This advisory warns that ostensibly free Android apps—primarily from unofficial app stores—embed third-party code that converts devices into hard-to-detect residential proxies. Those compromised devices are leveraged at scale for spam, automated account creation, account takeover, stolen browser identities, and click/ad fraud, creating broad abuse opportunities and persistent removal challenges for victims.