Wonderland Unleashed: New Android “Dropper” Malware Hijacks Telegram to Drain Bank Accounts

On 23 December 2025, a new Android “dropper” malware family dubbed Wonderland was highlighted by Group-IB as a significant evolution in how attackers target Android users in Uzbekistan. The researchers describe a shift from plain trojans to sophisticated droppers that deploy a malicious payload locally after installation, even without an active internet connection, and often masquerade as legitimate updates or harmless media files.

Wonderland is notable for being the first mass-spreading Android SMS stealer in the region to feature bidirectional C2 communication, enabling real-time command execution including arbitrary USSD requests and SMS sending. Telegram is the primary distribution vector, with attackers hijacking victims’ accounts to forward the malicious APK to contacts and even using fake bots such as @HUMOcardbot to harvest card details.

The report notes rapid malware maturation across three rounds—“Warm Up,” “Adaptation,” and the current phase—marked by heavy obfuscation, anti-analysis techniques, and checks for sandbox or rooted environments. Specific droppers like MidnightDat use a native library to decrypt a hidden payload with XOR encryption and compression, while data from a cybercriminal group’s Telegram channel suggests profits of more than $2 million in 2025.