{"id":4479,"date":"2022-01-27T19:45:02","date_gmt":"2022-01-27T14:15:02","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=4479"},"modified":"2022-01-27T19:45:04","modified_gmt":"2022-01-27T14:15:04","slug":"how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/","title":{"rendered":"How around Millions of Android Users Targeted by Subscriptions fraud Operations?"},"content":{"rendered":"\n
A premium services subscription scam for Android has been operating for close to two years. Called \u2018Dark Herring\u2019, the operation utilized 470 Google Play Store apps and affected over 100 million users worldwide, probably causing hundreds of millions of USD in total losses.<\/p><\/p>\n\n\n\n
\u2018Dark Herring\u2019 was present in 470 applications on the Google Play Store, Android\u2019s official and most trustworthy source of apps, with the earliest submission dating to March 2020. In total, the fraudulent apps were installed by 105 million users in 70 countries, subscribing them to premium services that charged $15 per month through Direct Carrier Billing (DCB).<\/p><\/p>\n\n\n\n
DCB is a mobile payment option that lets people purchase digital content from the Play Store, charging it to their prepaid balance or postpaid bill. The operators of \u2018Dark Herring\u2019 cashed the subscriptions while users realized the fraudulent charges much later, sometimes several months after the infection.<\/p><\/p>\n\n\n\n
The discovery of \u2018Dark Herring\u2019 comes from Xiarch, a Google partner and member of the Google App Defense Alliance, whose goal is to tackle the malware problem on the Play Store.<\/p><\/p>\n\n\n\n
What are the Functionality of Malware<\/strong>?<\/h2>\n\n\n\n
The long-term success of the Dark Herring relied on AV anti-detection capabilities, propagation through a large number of apps, code obfuscation, and the use of proxies as first-stage URLs. While none of the above is new or groundbreaking, seeing them combined into a single piece of software is rare for Android fraud.<\/p><\/p>\n\n\n\n
Moreover, the actors used a sophisticated infrastructure that received communications from all users of the 470 applications but handled each separately based on a unique identifier. The installed app doesn\u2019t contain any malicious code but features a hard-coded encrypted string that points to a first-stage URL hosted on Amazon’s CloudFront.<\/p><\/p>\n\n\n\n
The response from the server contains links to additional JavaScript files hosted on AWS instances, which are downloaded onto the infected device.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
These scripts prepare the app to acquire its configuration in relation to the victim, generate the unique identifiers, fetch the language and country details and determine which DCB platform is applicable in each case. Finally, the app serves a customized WebView page that prompts the victim to enter their phone number, supposedly receive a temporary OTP (one-time pass code) code to activate the account on the application.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
What are the Apps and targets?<\/strong><\/h2>\n\n\n\n
With 470 applications to distribute the malware, the targeted demographics was quite diverse. Most of these apps fell in the broader and more popular \u201cEntertainment\u201d category. Other prevalent Dark Herring apps were photography tools, casual games, utilities, and productivity apps.<\/p><\/p>\n\n\n\n
One key factor in the consequences of the Dark Herring operation is the absence of DCB consumer protection laws, so some countries were targeted more zestfully than others. Those at greater risk were India, Pakistan, Saudi Arabia, Egypt, Greece, Finland, Sweden, Norway, Bulgaria, Iraq, and Tunisia.<\/p><\/p>\n\n\n\n
<\/figure><\/div>\n\n\n\n
Even in countries where strict DCB protection rules apply, if the victims are late to realize the fraud, reverting the transactions may be impossible. The most popular Dark Herring apps that each counts several million downloads are:<\/p><\/p>\n\n\n\n
Smashex<\/li>
Upgradem<\/li>
Stream HD<\/li>
Vidly Vibe<\/li>
Cast It<\/li>
My Translator Pro<\/li>
New Mobile Games<\/li>
StreamCast Pro<\/li>
Ultra Stream<\/li>
Photograph Labs Pro<\/li>
VideoProj Lab<\/li>
Drive Simulator<\/li>
Speedy Cars \u2013 Final Lap<\/li>
Football Legends<\/li>
Football HERO 2021<\/li>
Grand Mafia Auto<\/li>
Offroad Jeep Simulator<\/li>
Smashex Pro<\/li>
Racing City<\/li>
Connectool<\/li>
City Bus Simulator 2<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"
A premium services subscription scam for Android has been operating for close to two years. Called \u2018Dark Herring\u2019, the operation utilized 470 Google Play Store apps and affected over 100 million users worldwide, probably causing hundreds of millions of USD in total losses. \u2018Dark Herring\u2019 was present in 470 applications on the Google Play Store, […]<\/p>\n","protected":false},"author":2,"featured_media":4484,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"\n
How around Millions of Android Users Targeted by Subscriptions fraud Operations? - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How around Millions of Android Users Targeted by Subscriptions fraud Operations? - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"A premium services subscription scam for Android has been operating for close to two years. Called \u2018Dark Herring\u2019, the operation utilized 470 Google Play Store apps and affected over 100 million users worldwide, probably causing hundreds of millions of USD in total losses. \u2018Dark Herring\u2019 was present in 470 applications on the Google Play Store, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-01-27T14:15:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-01-27T14:15:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"How around Millions of Android Users Targeted by Subscriptions fraud Operations?\",\"datePublished\":\"2022-01-27T14:15:02+00:00\",\"dateModified\":\"2022-01-27T14:15:04+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/\"},\"wordCount\":555,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/\",\"url\":\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/\",\"name\":\"How around Millions of Android Users Targeted by Subscriptions fraud Operations? - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2022-01-27T14:15:02+00:00\",\"dateModified\":\"2022-01-27T14:15:04+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How around Millions of Android Users Targeted by Subscriptions fraud Operations?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How around Millions of Android Users Targeted by Subscriptions fraud Operations? - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/","og_locale":"en_US","og_type":"article","og_title":"How around Millions of Android Users Targeted by Subscriptions fraud Operations? - Xiarch Solutions Private Limited","og_description":"A premium services subscription scam for Android has been operating for close to two years. Called \u2018Dark Herring\u2019, the operation utilized 470 Google Play Store apps and affected over 100 million users worldwide, probably causing hundreds of millions of USD in total losses. \u2018Dark Herring\u2019 was present in 470 applications on the Google Play Store, […]","og_url":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2022-01-27T14:15:02+00:00","article_modified_time":"2022-01-27T14:15:04+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"How around Millions of Android Users Targeted by Subscriptions fraud Operations?","datePublished":"2022-01-27T14:15:02+00:00","dateModified":"2022-01-27T14:15:04+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/"},"wordCount":555,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/","url":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/","name":"How around Millions of Android Users Targeted by Subscriptions fraud Operations? - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2022-01-27T14:15:02+00:00","dateModified":"2022-01-27T14:15:04+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/how-around-millions-of-android-users-targeted-by-subscriptions-fraud-operations\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How around Millions of Android Users Targeted by Subscriptions fraud Operations?"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4479"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=4479"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4479\/revisions"}],"predecessor-version":[{"id":4485,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/4479\/revisions\/4485"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/4484"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=4479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=4479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=4479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-image1\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-image1.jpg\")
<\/figure><\/div>\n\n\n\n![\"How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-image2\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-image2.jpg\")
<\/figure><\/div>\n\n\n\n![\"How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-image3\"](\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2022\/01\/How-around-Millions-of-Android-Users-Targeted-by-Subscriptions-fraud-Operations-image3-1024x516.jpg\")
<\/figure><\/div>\n\n\n\n