Your Phone is Not Your Phone: A Dive Into SMS PVA Fraud
summary
A criminal operation preloads Android ROMs and OTA updates to control an estimated 20M devices across 180 countries, installs a plugin framework that captures SMS by matching regular expressions and briefly locks a phone for five minutes to harvest codes, and exposes devices as SOCKS5 residential and mobile proxies with GPS-linked locations. The infrastructure returns captured OTPs and account tokens to an API, creates thousands of PVA accounts (starbucks promo abuse hit ~400k accounts), and is monetized via ad fraud, proxy rental and scam campaigns — and it works at global scale.
AI-written summary · about
chapters (9)
- 0:00Start
- 4:02Historical Overview
- 11:23Main Supply Chain Attack vectors
- 11:44SDK infections: example
- 13:49Free SMS Verification Codes?
- 14:46Lemon SMS PVA Platform
- 22:23Lemon group also Sells Proxies
- 23:21Proxy Plugin (Guerilla)
- 29:22Impact to online platforms and services: SMS verification code cannot be trusted
related talks
33mSMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets
44mBehind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices
29mProtecting Phone Verification
42mThe Old is New Again: An Intro to SMS Security and Why It’s Vital
39mSecure Your Data
51mMoney Doesn't Stink - Cybercriminal Business Insight of A New Android Botnet
30mReversing Mobile Malware
52mCellular Exploitation on a Global Scale: The Rise and Fall of the Control Protocol