GriftHorse Android Trojan Steals Millions from Over 10 Million Victims Globally

**Executive Summary:** Zimperium zLabs details the GriftHorse Android Trojan—a sophisticated premium-SMS subscription fraud embedded in numerous Android apps (some on Google Play and many on third-party stores) that has infected an estimated 10+ million devices across 70+ countries since November 2020, using Cordova-based WebViews, encrypted C2 communication, geo-targeting and domain rotation to evade detection; the report includes app package names, hundreds of SHA-256 hashes, domains, and mitigation recommendations.