Behind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices
summary
Criminal enterprise pre-infects phones via compromised SDKs, modified OTA components and a tampered Android runtime that injects a main plugin DEX downloader into zygote; that loader pulls over 80 plugins from C2 servers (SMS interception that suppresses broadcasts, hidden ad rendering, proxy and silent install modules). Monetization includes 8.9 million devices online, renting infected phones as proxy rental 1,200s, and a silent installer installs APKs silently for pay — the infrastructure proves scalable and profitable.
AI-written summary · about
chapters (11)
- 0:00Session introduction
- 2:15Supply chain attack methods
- 6:07History of Android threats
- 11:50Analyzing the threat actor
- 18:00SMS verification fraud
- 21:00Mobile proxy services
- 24:08Ad promotion and spam
- 27:43Monetization strategies
- 31:36Impact and telemetry
- 34:21Evolving tactics and defense
- 39:04Conclusion and Q&A
related talks
37mYour Phone is Not Your Phone: A Dive Into SMS PVA Fraud
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
25mMobile App Security: Threat Landscape
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
30m"Latest Android threats and their techniques"
30mReversing Mobile Malware
33mSMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets