Joker Joking in Google Play

**Executive Summary:** This ThreatLabz analysis documents an active Joker Android malware campaign that repeatedly uploaded multiple malicious apps to Google Play (about 11 recent samples with ~30k installs), outlining targeted categories and publisher naming patterns, new evasion techniques (use of URL shorteners, changing C2 URIs, evolving string obfuscation), abuse of notification access to exfiltrate SMS/contacts and enroll victims in premium WAP services, staged payload innovations (XORed stage data, XXTEA-encrypted C2 communications, SIM-based targeting), and provides package names, IOCs and C2 hosts to aid detection and takedown.