{
  "family": "fakeinstaller",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:AndroidOS/Fakeinstaller is a massive, historically significant classification for a family of Android mobile malware designed to commit SMS Toll Fraud. These malicious applications masquerade as legitimate apps (like games, utilities, or even security software) on third-party app stores. Their sole purpose is to silently send premium-rate SMS text messages without the user's knowledge or consent, racking up massive charges on the victim's mobile phone bill.<br><br><b>Understanding Fakeinstaller (SMS Toll Fraud)</b><br>To an end-user, the infection often seems benign at first; the app might even provide the functionality it promised. However, the true impact is discovered weeks later when the mobile bill arrives. For a threat analyst, Fakeinstaller represents a highly lucrative, automated criminal enterprise that exploits the billing mechanics of mobile carriers.<br><br><b>Execution and Fraud Mechanics</b><br>Fakeinstaller is distributed primarily via unmoderated, third-party Android app stores or malicious links sent via SMS (Smishing). During installation, the crucial step occurs: the app requests the `SEND_SMS` Android permission. If granted, the malware activates upon installation or device boot (`RECEIVE_BOOT_COMPLETED`). It connects to a C2 server to retrieve a list of premium-rate shortcodes and the specific text strings required to trigger a billing event. It then silently sends these messages in the background (`T1624.001`). To evade detection by the user, many variants also utilize the `RECEIVE_SMS` permission to intercept and delete the confirmation texts sent back by the premium service, ensuring the victim remains unaware of the fraud.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct financial loss via carrier billing. Device-based IoCs include the presence of applications requesting SMS permissions (`SEND_SMS`, `RECEIVE_SMS`, `READ_SMS`) that have no legitimate need for them (e.g., a flashlight app requesting SMS access). A review of the device's outbound SMS logs (if the malware hasn't deleted them) will reveal texts sent to unknown 5-digit or 6-digit shortcodes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1437",
    "T1498",
    "T1624.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1624.001",
      "name": "Data from Information Repositories: Short Message Service (SMS) (Intercepting and deleting billing confirmation texts)",
      "tactic": "Collection"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Though less DoS, it abuses network billing services)",
      "tactic": "Impact"
    },
    {
      "id": "T1437",
      "name": "Application Layer Protocol (Communicating with C2 to fetch premium shortcodes)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately uninstall the suspicious application via the Android Settings > Apps menu.",
    "Contact the mobile carrier immediately to report the fraud, request a refund for the premium SMS charges, and place a block on all premium-rate billing.",
    "Review all installed applications and revoke SMS permissions from any app that does not strictly require it (like messaging apps).",
    "Consider performing a factory reset of the device if multiple malicious applications were installed."
  ],
  "what_to_avoid": [
    "Do not allow users to 'sideload' applications (installing APKs from outside the official Google Play Store).",
    "Avoid blindly granting permissions during app installation; scrutinize why an app needs the access it requests."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}