Mobile Malware · Real-World Cases · Lesson 2 of 5

Joker & Billing Fraud

How one malware family billed phone accounts and kept slipping back into Play.

Charges on the phone bill

In Android App Security you met Bread, also called Joker, as a classic Play Store dropper. This lesson is about how it actually made money. Google's Android security team described it in detail in a January 2020 post, saying it had tracked the family since early 2017.

Joker's business was billing fraud: signing victims up for paid services and charging them through their mobile carrier, so the cost lands on the phone bill instead of a card. Google described two kinds.

• SMS fraud (older versions): some carriers let you pay for a service by texting a keyword to a short number. The malware quietly sent that text.
• Toll fraud (newer versions): the carrier offers a payment web page, often called WAP billing. The page checks that the request comes from your phone, either because you're on mobile data or because you type in a code texted to you.

Google's key point was that these checks verify the device, not the person. The carrier can tell the request came from your phone, but nothing proves you meant it. Joker automated every step: it loaded the payment page out of sight, pressed the buttons, read the confirmation code from the incoming text, and typed it in. Microsoft's threat intelligence team, writing about toll fraud in June 2022, added that such apps switch off Wi-Fi or force their traffic over mobile data, and can dismiss the carrier's "you've subscribed" notification so the victim never sees it.

The charges are usually small and recurring. One disclosure screen Google translated, from a campaign aimed at Thai carriers, offered a service "from 9 Baht / day", under 30 US cents a day at the time. That's the point: small charges hide in a bill until they add up over months. Google also found the cancellation phone numbers shown were fake, and billing started even if the user never tapped Confirm.

For a victim, the practical checks are the phone bill and the carrier's list of premium or third-party subscriptions, which most carriers let you view and block.

Why it kept getting back into Play

Google said Play Protect had detected and removed about 1,700 unique Bread apps from the Play Store before anyone downloaded them. At peak times it saw up to 23 different Bread apps submitted to Play in a single day. Google's summary: sheer volume was the group's preferred approach.

Google described several ways the apps tried to slip through review:

• Versioning: publish a clean version first to build up users and a good developer reputation, then add the fraud in a later update. Some clean versions had everything except the one line that started billing.
• Cloaking: the app asked its server which mobile network the phone was on. If it wasn't a targeted carrier (a reviewer, say), the server sent nothing suspicious and the app just showed its content. Some servers only began giving real responses several days after an app was submitted.
• Hiding code: scrambled text, commercial packers, and moving key logic into native code, so scanners had less to match.
• Fake reviews: bursts of five star ratings at launch, later followed by one star reviews from real users.

Google's responses included new Play policies restricting which apps may use SMS permissions, which Google said pushed Joker away from SMS fraud, and treating updates exactly like new apps during analysis, which targets versioning.

The family adapted again. Kaspersky reported in May 2022 that Joker apps were often real apps with fraud code added, which stayed dormant until the app went live, and then downloaded the fraud part in up to four stages. Where an app had no believable reason to read texts, it asked for notification access instead, because notifications show the code. Kaspersky said trojanized apps were removed daily but new ones kept appearing, and listed other subscription families too.

How common is this today? Recent public reporting names Joker less often, but subscription fraud as a category keeps showing up in vendor reports. Treat any claim about its current scale as an estimate from the specific source.