{
  "family": "smsspy",
  "sample_count": 1,
  "category": "trojan",
  "description": "TrojanSpy:AndroidOS/Smsspy (or Win32 variants targeting mobile emulators/connected devices) is a specialized spyware focused entirely on intercepting and exfiltrating Short Message Service (SMS) data (`T1114.001`). Its primary, critical function is to bypass Multi-Factor Authentication (MFA) by silently reading the One-Time Passwords (OTPs) sent by banks during fraudulent transactions.<br><br><b>Understanding Smsspy (2FA Interceptors)</b><br>To an end-user, the infection is often unnoticed until they receive a notification of a cleared bank account. The SMS messages containing the authentication codes are often hidden from the user's inbox by the malware. For security teams, Smsspy highlights the inherent weakness of SMS-based 2FA against targeted banking attacks.<br><br><b>Execution and Interception Mechanics</b><br>Smsspy is typically distributed via third-party app stores, deceptive 'security update' SMS links (Smishing), or dropped by a primary banking trojan. Once installed, it requests the `READ_SMS` and `RECEIVE_SMS` Android permissions (`T1624`). It then establishes a background service to monitor all incoming messages. When a message arrives matching specific regex patterns (e.g., containing 'code', 'OTP', or originating from known bank shortcodes), it immediately exfiltrates the contents via HTTP/HTTPS to the attacker's C2 server (`T1041`), often deleting or marking the message as read locally to hide the activity from the victim.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total compromise of SMS-based MFA and potential severe financial loss. IoCs include unexpected apps possessing SMS-reading permissions, rapid battery drain, and network logs showing background HTTP POST requests immediately following the receipt of an SMS message.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1624",
    "T1114.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection (Adapted for SMS interception to steal OTPs)",
      "tactic": "Collection"
    },
    {
      "id": "T1624",
      "name": "Location and Audio/Video Capture (Adapted for requesting excessive SMS permissions)",
      "tactic": "Collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel (Sending intercepted SMS codes to the attacker in real-time)",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately disable the device's cellular connection (turn on Airplane Mode) to prevent further SMS interception and exfiltration.",
    "Contact financial institutions immediately to freeze accounts and report that SMS-based 2FA has been compromised.",
    "Identify and uninstall the malicious application granting itself SMS permissions (check Settings -> Apps -> Permissions).",
    "Transition all critical accounts from SMS-based 2FA to app-based authenticators (like Google Authenticator) or hardware keys (YubiKey)."
  ],
  "what_to_avoid": [
    "Do not assume a transaction is safe just because SMS 2FA is enabled; Smsspy exists specifically to defeat this mechanism.",
    "Avoid downloading applications from outside official app stores, as this is the primary delivery method for mobile spyware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}