Mobile Malware · Malware Basics · Lesson 3 of 5

How Attackers Make Money

Follow the money: codes, phone bills, fake ad taps, data, crypto and spyware.

Logins, codes and your phone bill

Almost all mobile malware is a business. If you understand how a family gets paid, you can predict what it will try to do on a phone.

Bank fraud pays the most per victim. A banking trojan steals the username and password, then needs the one-time code the bank sends to confirm a login or payment. That's why SMS access, notification access and accessibility are so valuable to criminals. Stolen money is usually moved quickly through accounts opened by money mules, people recruited (sometimes unknowingly) to receive and pass on funds.

Some groups skip the bank login and just harvest codes. In July 2024, Zimperium's researchers reported an SMS stealer campaign with over 105,000 samples that intercepted one-time codes for more than 600 services. It spread through fake ads and Telegram bots posing as real services, with most victims in India and Russia. Stolen codes like these can be used to take over or create accounts.

Billing fraud uses the phone bill as the payment method. Premium SMS fraud sends texts to paid short numbers. Toll fraud (carrier billing fraud) silently subscribes you to services charged through your carrier. You met Bread (Joker) in Android App Security. Google described how it started with SMS fraud and shifted toward toll fraud after Play limited which apps could use SMS permissions. Google also noted that billing fraud often needs tricks like switching off Wi-Fi, so the charge goes through the mobile network. Each victim loses only a few dollars a month, which is why many people don't notice for a long time.

Ad fraud turns the phone itself into the product. In March 2025, HUMAN's researchers described BADBOX 2.0, a scheme involving over a million cheap, uncertified Android devices (mainly TV boxes, tablets and projectors) that loaded hidden ads, faked clicks and sold access to the devices' internet connections. The FBI issued a public warning about it in June 2025. The owners mostly saw nothing beyond a slow device.

Data, crypto and spyware for sale

Selling data is the quiet end of the business. Some apps include a software development kit (SDK), a ready-made code library from another company, that collects location or device details and sells them. This often sits in the gray zone rather than counting as malware. In January 2024 the US Federal Trade Commission banned the data broker X-Mode Social (now Outlogic) from selling sensitive location data. The FTC said X-Mode's SDK collected location data inside other companies' apps and didn't make sure users had properly consented.

Crypto theft is attractive because transfers are fast and usually can't be reversed. A clipper watches the clipboard and swaps a copied wallet address for the attacker's. ESET found one on Google Play in February 2019, posing as the MetaMask wallet. In February 2025, Kaspersky described SparkCat, hidden in apps on both Google Play and the App Store. It used on-device text recognition to search the photo gallery for screenshots of wallet recovery phrases, the list of words that can restore a wallet, and sent matching images to the attackers. The lesson for users: never keep a recovery phrase as a photo.

Spyware as a product is the last model. Here the malware itself is what's sold. At the cheap end, stalkerware apps charge monthly subscriptions. At the expensive end are commercial surveillance vendors that sell to governments. In February 2024, Google's Threat Analysis Group said it was tracking about 40 such vendors. One example: in 2022, Lookout researchers analyzed Android spyware called Hermit and attributed it, with Google later confirming much of the work, to the Italian vendor RCS Lab. It was seen in Kazakhstan, Italy and Syria.

Notice how the money model shapes behavior. A clipper needs only the clipboard. A spyware product needs to stay hidden for months. That difference is a big clue during analysis.