Massive SMS stealer campaign infects Android devices in 113 countries

Zimperium researchers uncovered a global Android malware campaign (tracked since Feb 2022) that uses ~2,600 Telegram bots and malvertising to distribute SMS-stealing APKs — over 107,000 distinct samples were observed. The malware exfiltrates OTPs/SMS to an API at fastsms.su, enabling attackers or a service to monetize infected devices as virtual phone numbers for authentication and anonymization, primarily impacting users in India and Russia with notable victims in Brazil, Mexico, and the U.S.; users are advised to avoid sideloading APKs and restrict SMS permissions.