{ "family": "joker", "sample_count": 0, "category": "trojan", "description": "Joker (tracked extensively by Google Threat Analysis Group as 'Bread', and cataloged across mobile defense telemetry as Trojan.AndroidOS.Joker, Android.Joker, and Bread.Spyware) is an exceptionally persistent and polymorphic Android malware family first uncovered in 2017. Engineered specifically for telecom billing fraud, Joker specializes in executing unauthorized Wireless Application Protocol (WAP) billing subscriptions and premium-rate SMS toll fraud without user consent or knowledge. Threat actors behind Joker operate an aggressive, industrial-scale smuggling campaign, repeatedly circumventing Google Play Store security vetting by uploading thousands of seemingly benign utility applications—such as camera filters, wallpaper apps, PDF converters, and messaging extensions—containing minimal initial code. Once installed on a victim's smartphone, Joker executes a multi-stage obfuscated payload pipeline: it retrieves an encrypted secondary DEX payload disguised inside remote image headers via steganography or AWS/Firebase hosting, decrypts it locally using AES-256 or custom XOR routines, and loads executable classes dynamically via DexClassLoader. Joker requests sensitive Android permissions or exploits framework IPC vulnerabilities (such as CVE-2019-2187 and CVE-2020-0096) to silently gain NotificationListenerService access. Using this listener, Joker silently intercepts incoming two-factor authentication (2FA) SMS verification codes dispatched by mobile network carriers, auto-submits the confirmation codes on carrier subscription web portals in the background, and immediately suppresses the billing notification before the victim can observe it. Google TAG has removed over 1,700 unique Bread applications from the Play Store, documenting its continuous evolutionary shift from native C-library unpacking to commercial Android packers.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Android.Joker", "Trojan.AndroidOS.Joker", "Trojan:Android/Joker", "Bread.Spyware", "Android/Joker.BillingFraud", "Bread" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is Joker malware and what does it do on Android devices?", "acceptedAnswer": { "@type": "Answer", "text": "Joker (also called Bread) is an Android trojan designed for premium billing fraud. It surreptitiously subscribes infected users to high-cost WAP and SMS services without their authorization, inflating cellular phone bills." } }, { "@type": "Question", "name": "How does Joker bypass Google Play Store security vetting?", "acceptedAnswer": { "@type": "Answer", "text": "Joker developers upload completely clean or stripped-down dropper apps that masquerade as benign utilities. Once approved and installed, the app fetches an encrypted DEX payload dynamically via steganography or external staging servers, bypassing static app analysis." } }, { "@type": "Question", "name": "How does Joker intercept SMS confirmation codes?", "acceptedAnswer": { "@type": "Answer", "text": "Joker tricks users into granting Notification Listener access (NotificationListenerService) or exploits Android framework IPC vulnerabilities (CVE-2019-2187). It reads incoming SMS verification tokens from telecom providers and instantly hides the notification from the user." } }, { "@type": "Question", "name": "Why did Google TAG name the threat actor 'Bread'?", "acceptedAnswer": { "@type": "Answer", "text": "Google Threat Analysis Group dubbed the threat family 'Bread' because early variants contained references to money and slang terms for currency in their command-and-control strings and decompiled class namespaces." } }, { "@type": "Question", "name": "What should users do if they suspect an infected app on their device?", "acceptedAnswer": { "@type": "Answer", "text": "Uninstall suspected utility and wallpaper apps immediately, verify running accessibility and notification listener services in Android Settings, contact the cellular carrier to audit and dispute any unauthorized subscription charges, and run a full scan with Google Play Protect." } }, { "@type": "Question", "name": "How do mobile security solutions detect Joker variants?", "acceptedAnswer": { "@type": "Answer", "text": "Mobile security engines use behavioral heuristics to detect dynamic DEX classloading (DexClassLoader), analyze network traffic for hidden C2 requests fetching bitmap images with appended encrypted binaries, and flag unauthorized notification listener registration." } }, { "@type": "Question", "name": "How does Joker (Bread) evade Google Play Store security scanners using dynamic DEX payload loading?", "acceptedAnswer": { "@type": "Answer", "text": "Joker bypasses Google Play Store automated review pipelines by publishing seemingly benign Android apps (such as camera filters, SMS messengers, or wallpaper utilities) that contain no overt malicious code. Once installed on a victim device, the app contacts a remote staging server, downloads an encrypted second-stage DEX or APK file, and loads it dynamically into memory using DexClassLoader, completely evading static APK analysis." } }, { "@type": "Question", "name": "What techniques does Joker employ to silently intercept SMS verification codes and subscribe victims to WAP billing services?", "acceptedAnswer": { "@type": "Answer", "text": "Joker requests permissions to read SMS messages and notification listeners. It navigates to premium Wireless Application Protocol (WAP) billing websites in a hidden WebView, automatically fills in the victim's mobile phone number, intercepts the carrier's incoming SMS one-time password (OTP), and inputs the confirmation code into the billing form before silently deleting the SMS notification to prevent victim discovery." } } ], "faq_count": 8, "mitre_attack": [ "T1404", "T1418", "T1437", "T1412", "T1432", "T1636", "T1411" ], "cisa_advisory": null, "exploited_cves": [ "CVE-2019-2187", "CVE-2020-0096" ], "last_updated": "2026-10-16", "sources": [ { "name": "Google Threat Analysis Group: Hunting Bread (Joker)", "url": "https://security.googleblog.com/2020/01/bread-identifying-and-defeating-fraud.html" }, { "name": "Zimperium zLabs: Mobile Threat Intelligence on Joker Variants", "url": "https://www.zimperium.com/blog/joker-malware-analysis/" }, { "name": "Check Point Research: Tracking Joker Mobile Trojan Evolution", "url": "https://research.checkpoint.com/2020/the-return-of-the-joker/" }, { "name": "Trend Micro: Dissecting Steganography in Joker Android Payloads", "url": "https://www.trendmicro.com/en_us/research/20/d/joker-android-trojan-analysis.html" } ], "iocs": { "file_hashes": [ "0fbc15d8ec11f7142751f0f18858db1ef48cf6e9e4215ff52b99216ff8564c78", "45e8ef63447990d1bf4468202d0cfd69ffbfdf89c25bbdf64cfcba6f98762512", "7e937d5cb44e8bc1a3962d3a8247072bc5df5d6efb2326ef2799c51239c5ef90" ], "delivery": [ "Google Play Store utility applications masquerading as camera filters, SMS messaging plugins, and wallpapers", "Third-party Android application stores and malicious APK sideloading portals", "Dynamic payload retrieval fetching encrypted DEX files hidden inside remote bitmap image headers" ], "persistence": [ "Android Background Service registration with BOOT_COMPLETED intent receiver", "Abuse of NotificationListenerService permissions to maintain execution and suppress billing alerts", "Exploitation of Android framework IPC privilege escalation CVE-2019-2187 and CVE-2020-0096" ] }, "lineage": { "derived_from": [ "bread" ], "variants": [ "joker_v1", "joker_stego", "joker_dex_classloader" ] }, "ecosystem": [ "android" ], "attack_stage": [ "initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion", "credential_access", "collection", "exfiltration" ], "target_platforms": [ "Android" ] }