{
  "family": "smshoax",
  "sample_count": 7,
  "category": "trojan",
  "description": "Trojan:AndroidOS/Smshoax is a prevalent classification of mobile malware specifically designed to commit financial fraud by silently subscribing the victim to premium-rate SMS services or making unauthorized phone calls. While primarily targeting the Android ecosystem, variations exist across mobile platforms. This threat leverages the billing mechanisms of telecommunications carriers, directly draining the victim's prepaid balance or inflating their monthly phone bill.<br><br><b>Understanding SMS Hoax Fraud</b><br>To an end-user, the infection is often imperceptible until they receive their monthly phone bill showing exorbitant charges for 'premium text services' or international calls they never made. For security analysts, this represents a highly lucrative, automated monetization scheme. The malware acts as a silent proxy, interacting with carrier billing APIs without the user's knowledge or consent.<br><br><b>Execution and Fraud Mechanics</b><br>Smshoax is typically distributed via third-party app stores, disguised as legitimate applications (like games, wallpaper apps, or adult content) (`T1533`). Upon installation (`T1204`), the malware requests excessive permissions, specifically `SEND_SMS`, `READ_SMS`, and `CALL_PHONE` (`T1614.001`). Once granted, it operates in the background. It utilizes its C2 server to receive a list of premium-rate numbers. It then silently sends SMS messages to these numbers (`T1629`). Crucially, to hide its activity from the user, the malware intercepts and immediately deletes the confirmation SMS messages sent back by the premium service or the carrier (`T1562.001`), ensuring the user remains completely unaware they have been subscribed to a recurring, expensive service.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct financial loss for the user. Technical IoCs on the mobile device include an unknown application holding SMS and Phone permissions. Behavioral IoCs include unexpected drops in prepaid mobile balances, unexplained premium charges on phone bills, and the device sending outbound SMS messages to shortcodes (e.g., 5-digit numbers) without user interaction.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1629",
    "T1614.001",
    "T1533",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1629",
      "name": "Financial Theft: SMS Toll Fraud (Sending premium SMS messages)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Intercepting and deleting incoming SMS alerts)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1614.001",
      "name": "System Location Discovery: Location Tracking (Often bundled to target specific regional carriers)",
      "tactic": "Discovery"
    },
    {
      "id": "T1533",
      "name": "Data from Local System (Harvesting contact lists for further spam)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately boot the Android device into Safe Mode to prevent third-party applications from running.",
    "Navigate to the Application Manager, locate the suspicious app (often the most recently installed game or utility), and uninstall it.",
    "Contact the mobile telecommunications carrier immediately to report the fraud, dispute the charges, and request a hard block on all premium-rate SMS billing.",
    "Review and revoke excessive permissions (like `SEND_SMS`) for all remaining applications on the device."
  ],
  "what_to_avoid": [
    "Do not ignore small, unexplained charges on a mobile bill; SMS fraud often starts small to avoid detection before ramping up.",
    "Avoid downloading applications from unverified, third-party app stores or side-loading APKs from unknown websites."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}