Ongoing Roaming Mantis smishing campaign targeting France

This Sekoia report details an ongoing Roaming Mantis smishing campaign targeting France that delivers the MoqHao (Wroba/XLoader) Android RAT and French-language Apple ID credential-phishing pages via malicious SMS links; it describes the geofenced infection chain, Android permissions and C2 retrieval (via Imgur dead-drop resolvers), lists extensive IoCs (domains, IPs, APK SHA256), and maps observed behaviors to MITRE ATT&CK TTPs.