Uzbek Users Under Attack by Android SMS Stealers

Uzbek users are being targeted by Android SMS stealer malware, with researchers noting a new wave of attacks that began in October and were observed by Group-IB on December 19. According to Group-IB, multiple threat groups are involved in the campaign, including TrickyWonders, Blazefang, and Ajina, and the malware is distributed as an APK file presented as a safe application to sideload or sent via Telegram.

The attackers leverage Telegram to gain access to targets’ devices and numbers, then try to coerce the victim’s contacts into installing the malicious apps, spreading the infection further, a method said to be popular because Telegram is the dominant instant messaging platform in Uzbekistan. The campaign uses a range of tools, including the Wonderland SMS stealer, the MidnightDat dropper, the RoundRift AES-based dropper, the Ajina[.]Banker money-stealer, and the Qwizzserial SMS stealer.

Group-IB notes that the threat ecosystem continues to evolve, with attackers improving distribution and obfuscation techniques to maintain control over infected devices.