Dynamically Evolving SMS Stealer Threatens Global Android Users

Researchers tracked a large, evolving Android malware campaign called "SMS Stealer" that has produced over 107,000 samples and infected users in 113 countries by distributing dynamically generated malicious apps via Telegram bots and deceptive ads. The trojan requests SMS permissions after sideloading, connects to multiple command-and-control servers (at least 13) and exfiltrates SMS messages—primarily OTPs—for account takeover, credential theft, and further fraud; the campaign uses ~2,600 Telegram bots and targets users of over 60 major brands, evading signature-based defenses and highlighting the need for stronger mobile threat protection.