Mobile Malware · Malware Basics · Lesson 5 of 5

Challenge: Uncle Ray's Phone Bill

Help a relative work out what his strange new app is really doing.

The mystery charges

Your Uncle Ray calls. Two months ago a text said his phone was "infected" and linked to a site offering Fast Cleaner. He tapped Download, allowed installs from that browser, and installed it. The app does show a cleaning animation.

Now his carrier bill shows a new line, "Premium Content Svc", at $7.99 a month for the last two months, which he never signed up for. He also noticed his Wi-Fi keeps turning itself off at night, and he hasn't seen any extra ads or pop-ups. His bank accounts look normal so far.

You remember that each malware type is defined by what it's trying to get, and that different families have different money models. Charges on a phone bill, with no stolen bank logins, point to one particular model. The Wi-Fi switching off is a clue too: billing through the carrier works over the mobile network, not home Wi-Fi.

The setting he unlocked

Ray mentions that a week after installing, Fast Cleaner showed a pop-up: "Turn on Smart Boost for faster cleaning." When he tried to switch it on in Accessibility, his Android 14 phone said the setting was unavailable for his security. The app then showed step-by-step pictures telling him to open its App info page, tap the menu, and allow something. After that, Android warned him the app would get full control, and he tapped Allow.

The photo in the gallery

While checking the phone with Ray, you notice he has a crypto wallet app. Proudly, he shows you how he keeps his wallet safe: he took a screenshot of his 12 recovery words and saved it in his photo gallery "so I won't lose them". He also has a habit of copying wallet addresses from chat messages when friends pay him back.

Is it the government?

Ray is now worried. "Is someone after me personally? I read about spyware used against journalists." He's a retired plumber, not a public figure. His phone got the infection from a text link that, it turns out, several neighbors also received. The app came from a website, not an app store, and asked for accessibility through on-screen tricks rather than using any software flaw.

You need to explain, kindly and accurately, what kind of attack this is, and that the habits from this course (official stores, Play Protect, updates, care with powerful permissions) are what protect people in his position.