Uzbek Users Under Attack by Android SMS-Stealers

Group-IB observed a new wave of Android-focused malware attacks in Uzbekistan beginning in October, where multiple threat actors (including TrickyWonders, Blazefang, and Ajina) distribute malicious APKs via sideloading and compromised Telegram accounts to deploy SMS stealers and banking trojans (e.g., Wonderland, Ajina.Banker, Qwizzserial). Attackers use droppers (MidnightDat, RoundRift), strong obfuscation, fake uninstall prompts, and frequent changes to domains/package names to evade detection, enabling repeated fund withdrawals and rapid propagation through victims' contact lists; defenders are advised to monitor user sessions, use threat intelligence, and factory-reset infected devices.