Android OS-Level Attack Bypasses Mobile Payment Security

CloudSEK researchers identified a new Android attack technique that uses the LSPosed framework and a module dubbed "Digital Lutera" to inject system-level hooks that intercept SMS messages, spoof device identifiers, and extract 2FA in real time, enabling large-scale payment fraud and account takeovers while bypassing app signatures and protections like Google Play Protect; activity has been observed being coordinated on Telegram and the method undermines SIM-binding and device-reported signals used by banks.