SMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets
summary
Researchers uncover a supply‑chain mobile botnet that arrives on low‑cost phones as preinstalled guerrilla/triada loaders, hooks the zygote process, and pushes encrypted plugins that intercept SMS OTPs and open residential/mobile proxies. The operation sells OTPs and proxied IPs via Lemon SMS PVA and Dove proxy, advertises thousands of country numbers, ties to ~122k IPs for Bangladesh, and monetizes via crypto top‑ups (estimated ~$660k total); the system reliably creates bulk verified accounts and bypasses regional checks.
AI-written summary · about
chapters (9)
- 0:00Mobile botnet supply-chain attacks
- 2:09Firmware supply-chain vulnerabilities
- 7:02Notable mobile supply-chain incidents
- 10:35SMS verification and cybercrime
- 14:28Lemon Group’s botnet infrastructure
- 20:50SMS PVA and proxy services
- 25:46Security and privacy implications
- 27:56Mobile botnet evolution and persistence
- 30:43Countermeasures for stakeholders
related talks
37mYour Phone is Not Your Phone: A Dive Into SMS PVA Fraud
29mProtecting Phone Verification
44mBehind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices
51mMoney Doesn't Stink - Cybercriminal Business Insight of A New Android Botnet
42mThe Old is New Again: An Intro to SMS Security and Why It’s Vital
48m2FA2Furious: New Threats to MFA
45mOTP Bot Attacks
31mFlubot - Pandemic in Our Pockets