Quick Summary
Zimperium’s zLabs has identified a significant increase in mobile malware targeting one-time passwords (OTPs) since February 2022, tracking over 107,000 malware samples. This Android-targeted campaign employs deceptive tactics, including malicious advertisements and Telegram bots, to trick users into installing harmful applications. The malware intercepts OTPs from SMS messages, allowing attackers to gain unauthorized access to sensitive accounts across 600 global brands, primarily affecting users in Russia and India.
The Securityish Brief
Zimperium’s zLabs has been monitoring a large-scale campaign since February 2022 that targets Android devices with malware designed to steal one-time passwords (OTPs). Researchers have identified over 107,000 unique malware samples, showcasing the attackers’ persistence and sophistication. The malware typically infects devices by tricking users into sideloading malicious applications through deceptive ads or automated Telegram bots.
Once installed, the malware requests high-risk SMS read permissions, enabling it to intercept OTPs used for account verification. This allows attackers to bypass security measures and access sensitive accounts. The campaign has affected users in 113 countries, with Russia and India being the primary targets.
Attackers have employed various deceptive tactics, including mimicking trusted sources and using Telegram bots to lure victims. For example, victims searching for unofficial Android applications may interact with a bot that requests their phone number and sends a customized malicious APK. This enables attackers to personalize their attacks and steal sensitive information.
The malware connects to Command and Control (C&C) servers to execute commands and collect stolen data. Initially, Firebase was used for C&C connections, but attackers have adapted by utilizing GitHub repositories to share C&C details and distribute malicious APKs.
The scale of this malware campaign is staggering, with over 95% of the samples being unknown or unavailable in common repositories. This highlights the attackers’ ability to evade detection. Researchers have identified 13 C&C servers linked to the campaign and a network of roughly 2,600 Telegram bots.
While the exact motives behind the campaign remain unclear, financial gain is a likely driver, as evidenced by connections to websites offering services for OTP interception. The use of cryptocurrency for payments further supports this motive.
The rise of OTP-stealing malware poses significant threats to individuals and organizations alike. Zimperium’s Mobile Threat Defense (MTD) solution is designed to protect against such evolving threats by leveraging machine learning and behavioral analysis to ensure comprehensive threat detection and mitigation.
Understanding the Risks
Organizations and users must be aware of the evolving tactics used by cybercriminals to steal sensitive information. The use of deceptive advertisements and social engineering tactics can lead to malware infections that compromise personal data.
Key Takeaways
- Be cautious of downloading apps from unofficial sources to avoid malware infections.
- Regularly review app permissions on your device, especially SMS read permissions.
- Monitor your accounts for unauthorized access, particularly after receiving OTPs.
- Consider using a Mobile Threat Defense solution to enhance security against evolving malware threats.
- Stay informed about the latest cybersecurity threats and best practices to protect your personal information.
Key Terms & Concepts
- One-time password (OTP): In this article, OTP refers to a temporary code used for account verification to enhance security.
- Command and Control (C&C): C&C refers to the infrastructure used by attackers to control compromised devices and collect stolen data.
- Sideloading: Sideloading is the process of installing applications from sources other than official app stores, which can pose security risks.
- Malware: In this article, malware refers to malicious software designed to infiltrate devices and steal sensitive information.
- Telegram bots: Telegram bots are automated accounts on the messaging platform Telegram that can interact with users and perform tasks.
Read the original article here: https://www.cybersecurity-insiders.com/the-growing-threat-of-otp-stealing-malware-insights-from-zimperiums-zlabs/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
