Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

Threat researchers have observed Android malware operations merging dropper delivery, SMS theft, and remote‑access capabilities at scale, with Wonderland (formerly WretchedCat) used in attacks targeting Uzbek users.

According to Group-IB, the Sudoku of the operation involves dropper apps masquerading as legitimate software that deliver Wonderland’s payload locally after installation, even without an active internet connection, and enabling bidirectional command-and-control for real‑time commands, including arbitrary USSD requests and SMS theft.

The financially motivated threat actor behind Wonderland is TrickyWonders, which coordinates via Telegram; two dropper families associated with the operation are MidnightDat (first seen on 27 August 2025) and RoundRift (first seen on 15 October 2025). Wonderland is spread through fake Google Play pages, Facebook ad campaigns, dating apps, and Telegram‑based distribution, with attackers abusing stolen Telegram sessions to propagate APKs to victims’ contacts.

Once installed, the malware can intercept OTPs, exfiltrate contacts and phone numbers, hide push notifications, and even send SMS messages for lateral movement, with sideloading requiring users to enable installation from unknown sources. The researchers note the infrastructure is increasingly dynamic and resilient, using rapidly changing domains and a modular, obfuscated design to hinder reverse engineering and takedown efforts.