{
  "family": "smshoax",
  "sample_count": 7,
  "category": "trojan",
  "description": "Trojan:AndroidOS/Smshoax is a prevalent classification of mobile malware specifically designed to commit financial fraud by silently subscribing the victim to premium-rate SMS services or making unauthorized phone calls. While primarily targeting the Android ecosystem, variations exist across mobile platforms. This threat leverages the billing mechanisms of telecommunications carriers, directly draining the victim's prepaid balance or inflating their monthly phone bill.<br><br><b>Understanding SMS Hoax Fraud</b><br>To an end-user, the infection is often imperceptible until they receive their monthly phone bill showing exorbitant charges for 'premium text services' or international calls they never made. For security analysts, this represents a highly lucrative, automated monetization scheme. The malware acts as a silent proxy, interacting with carrier billing APIs without the user's knowledge or consent.<br><br><b>Execution and Fraud Mechanics</b><br>Smshoax is typically distributed via third-party app stores, disguised as legitimate applications (like games, wallpaper apps, or adult content) (`T1533`). Upon installation (`T1204`), the malware requests excessive permissions, specifically `SEND_SMS`, `READ_SMS`, and `CALL_PHONE` (`T1614.001`). Once granted, it operates in the background. It utilizes its C2 server to receive a list of premium-rate numbers. It then silently sends SMS messages to these numbers (`T1629`). Crucially, to hide its activity from the user, the malware intercepts and immediately deletes the confirmation SMS messages sent back by the premium service or the carrier (`T1562.001`), ensuring the user remains completely unaware they have been subscribed to a recurring, expensive service.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct financial loss for the user. Technical IoCs on the mobile device include an unknown application holding SMS and Phone permissions. Behavioral IoCs include unexpected drops in prepaid mobile balances, unexplained premium charges on phone bills, and the device sending outbound SMS messages to shortcodes (e.g., 5-digit numbers) without user interaction.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Smshoax and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Smshoax is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Smshoax establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Smshoax typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Smshoax compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Smshoax should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Smshoax?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Smshoax frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Smshoax across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Smshoax by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1629",
    "T1614.001",
    "T1533",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1629",
      "name": "Financial Theft: SMS Toll Fraud (Sending premium SMS messages)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Intercepting and deleting incoming SMS alerts)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1614.001",
      "name": "System Location Discovery: Location Tracking (Often bundled to target specific regional carriers)",
      "tactic": "Discovery"
    },
    {
      "id": "T1533",
      "name": "Data from Local System (Harvesting contact lists for further spam)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately boot the Android device into Safe Mode to prevent third-party applications from running.",
    "Navigate to the Application Manager, locate the suspicious app (often the most recently installed game or utility), and uninstall it.",
    "Contact the mobile telecommunications carrier immediately to report the fraud, dispute the charges, and request a hard block on all premium-rate SMS billing.",
    "Review and revoke excessive permissions (like `SEND_SMS`) for all remaining applications on the device."
  ],
  "what_to_avoid": [
    "Do not ignore small, unexplained charges on a mobile bill; SMS fraud often starts small to avoid detection before ramping up.",
    "Avoid downloading applications from unverified, third-party app stores or side-loading APKs from unknown websites."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}