Joker

Category: trojan · Aliases: Android.Joker, Trojan.AndroidOS.Joker, Trojan:Android/Joker, Bread.Spyware, Android/Joker.BillingFraud, Bread · Sample count (EMBER 2018): 0 · Enrichment: curated_sourced · Updated: 2026-10-16
Category: TrojanStatus: Automated SignaturePlatform: ANDROIDStage: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Collection, Exfiltration🕸 Explore Relationship Graph⚙ API JSON⚡ Sigma Rule💾 YARA RuleOS: Android
Executive Summary
Joker (tracked extensively by Google Threat Analysis Group as 'Bread', and cataloged across mobile defense telemetry as Trojan.AndroidOS.Joker, Android.Joker, and Bread.Spyware) is an exceptionally persistent and polymorphic Android malware family first uncovered in 2017.

Table of Contents

Overview

Joker (tracked extensively by Google Threat Analysis Group as 'Bread', and cataloged across mobile defense telemetry as Trojan.AndroidOS.Joker, Android.Joker, and Bread.Spyware) is an exceptionally persistent and polymorphic Android malware family first uncovered in 2017. Engineered specifically for telecom billing fraud, Joker specializes in executing unauthorized Wireless Application Protocol (WAP) billing subscriptions and premium-rate SMS toll fraud without user consent or knowledge. Threat actors behind Joker operate an aggressive, industrial-scale smuggling campaign, repeatedly circumventing Google Play Store security vetting by uploading thousands of seemingly benign utility applications—such as camera filters, wallpaper apps, PDF converters, and messaging extensions—containing minimal initial code. Once installed on a victim's smartphone, Joker executes a multi-stage obfuscated payload pipeline: it retrieves an encrypted secondary DEX payload disguised inside remote image headers via steganography or AWS/Firebase hosting, decrypts it locally using AES-256 or custom XOR routines, and loads executable classes dynamically via DexClassLoader. Joker requests sensitive Android permissions or exploits framework IPC vulnerabilities (such as CVE-2019-2187 and CVE-2020-0096) to silently gain NotificationListenerService access. Using this listener, Joker silently intercepts incoming two-factor authentication (2FA) SMS verification codes dispatched by mobile network carriers, auto-submits the confirmation codes on carrier subscription web portals in the background, and immediately suppresses the billing notification before the victim can observe it. Google TAG has removed over 1,700 unique Bread applications from the Play Store, documenting its continuous evolutionary shift from native C-library unpacking to commercial Android packers.

Known aliases

Threat reports may refer to this family under multiple names:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Bread

Known Derivatives & Downstream Variants: Joker_V1 · Joker_Stego · Joker_Dex_Classloader

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1404 · T1418 · T1437 · T1412 · T1432 · T1636 · T1411

→ Explore the complete 226-Technique ATT&CK Threat Matrix

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

D3FEND IDCountermeasure NameTacticCountered ATT&CKDefensive Guidance
D3-DNSADNS Query AnalysisDetectT1404Monitor DNS queries from non-interactive system services and enforce secure encrypted DNS over TLS (DoT) egress policies.
D3-SCASegmented Cloud Storage AccessIsolateT1636Enforce strict IAM service account policies and VPC Service Controls to prevent staging of sensitive data to unapproved cloud buckets.

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

Delivery vectors

Persistence mechanisms

SIEM / EDR Ingestion: Need these reference indicators for threat hunting?

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

Tier 1 Primitive Artifact Rule (Fast Triage)

Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.

rule MALWARE_WIN_JOKER_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Joker"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "joker" ascii wide nocase
        $s2 = "android.joker" ascii wide nocase
        $s3 = "trojan.androidos.joker" ascii wide nocase
        $s4 = "trojan:android/joker" ascii wide nocase
        $s5 = "bread.spyware" ascii wide nocase
        $s6 = "android/joker.billingfraud" ascii wide nocase
        $s7 = "bread" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Tier 2 Behavioral Context Rule (Process Chains & Sigma)

Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.

title: SystemHelpDesk Detection - Joker (Trojan) Execution & Triage
id: 9410e921-dd7f-5412-9f52-b4e2ce59e931
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Joker malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/joker
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1404
- attack.t1418
- attack.t1437
- attack.t1412
- attack.t1432
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

Tier 3 Attribution Fingerprint Rule (High Fidelity)

Deep signature matching distinctive operational fingerprints and payload characteristics.

rule MALWARE_WIN_JOKER_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Joker tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "joker" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}
SOC & SIEM Rule Downloads: ⬇ Download YARA Rule (.yar) ⬇ Download Sigma Rule (YAML) ⬇ Download Sigma Rule (JSON) ⚙ Threat Profile API (JSON)

References & External Analysis

Frequently Asked Questions

What is Joker malware and what does it do on Android devices?

Joker (also called Bread) is an Android trojan designed for premium billing fraud. It surreptitiously subscribes infected users to high-cost WAP and SMS services without their authorization, inflating cellular phone bills.

How does Joker bypass Google Play Store security vetting?

Joker developers upload completely clean or stripped-down dropper apps that masquerade as benign utilities. Once approved and installed, the app fetches an encrypted DEX payload dynamically via steganography or external staging servers, bypassing static app analysis.

How does Joker intercept SMS confirmation codes?

Joker tricks users into granting Notification Listener access (NotificationListenerService) or exploits Android framework IPC vulnerabilities (CVE-2019-2187). It reads incoming SMS verification tokens from telecom providers and instantly hides the notification from the user.

Why did Google TAG name the threat actor 'Bread'?

Google Threat Analysis Group dubbed the threat family 'Bread' because early variants contained references to money and slang terms for currency in their command-and-control strings and decompiled class namespaces.

What should users do if they suspect an infected app on their device?

Uninstall suspected utility and wallpaper apps immediately, verify running accessibility and notification listener services in Android Settings, contact the cellular carrier to audit and dispute any unauthorized subscription charges, and run a full scan with Google Play Protect.

How do mobile security solutions detect Joker variants?

Mobile security engines use behavioral heuristics to detect dynamic DEX classloading (DexClassLoader), analyze network traffic for hidden C2 requests fetching bitmap images with appended encrypted binaries, and flag unauthorized notification listener registration.

How does Joker (Bread) evade Google Play Store security scanners using dynamic DEX payload loading?

Joker bypasses Google Play Store automated review pipelines by publishing seemingly benign Android apps (such as camera filters, SMS messengers, or wallpaper utilities) that contain no overt malicious code. Once installed on a victim device, the app contacts a remote staging server, downloads an encrypted second-stage DEX or APK file, and loads it dynamically into memory using DexClassLoader, completely evading static APK analysis.

What techniques does Joker employ to silently intercept SMS verification codes and subscribe victims to WAP billing services?

Joker requests permissions to read SMS messages and notification listeners. It navigates to premium Wireless Application Protocol (WAP) billing websites in a hidden WebView, automatically fills in the victim's mobile phone number, intercepts the carrier's incoming SMS one-time password (OTP), and inputs the confirmation code into the billing form before silently deleting the SMS notification to prevent victim discovery.

How do I remove the Joker Trojan from Windows?

Manual removal of Joker is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Joker a virus or a Trojan?

Joker is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Joker typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Joker infection?

Symptoms of Joker can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Protect Your Network Against Trojans

Want to prevent Joker and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection for Businesses.

📣 Threat Intel Correction or Update?

Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.

Need help with an active incident? Published by the SystemHelpdesk threat intelligence team.

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/joker.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.