Android apps targeting JIO users in India

This Zscaler ThreatLabZ report details an Android malware campaign active since 2020 that leverages topical India-related social engineering (e.g., TikTok return, free Lenovo laptop) to trick users into installing malicious APKs hosted on attacker-controlled GitHub/Weebly pages. The malware requests permissions, prompts victims to share the app via WhatsApp, targets Jio subscribers by identifying contacts and SIMs, sends SMS to spread, displays ads for monetization, and includes reused cryptographic keys and multiple SDKs; the report provides technical analysis, TTPs and extensive IOCs (MD5s, package names, distribution URLs, GitHub handles).