Joker is No Laughing Matter: 64 New Variants Discovered in Less Than a Month

Zimperium researchers report discovery of 64 previously unreported variants of the Joker Android trojan, documenting the typical attack chain (string decryption to retrieve stage URL, downloading an obfuscated dex payload, dynamic loading via DexClassLoader and C2 communication) and new evasion techniques including AES encryption, use of resource strings, and injection into content providers; the blog includes multiple indicators of compromise (domains, package names) and recommends on-device detection to mitigate these mobile-billing fraud threats.