Security researchers have found a massive malware operation that has infected more than 10 million Android smartphones across more than 70 countries since at least November 2020.
The GriftHorse malware has been distributed via benign-looking apps. After installing an infected app, GriftHorse starts showing users notifications that offer various prizes. Users who tap on these notifications are redirected to an online page where which signs the user up to premium SMS services that charge over €30 (£25) per month.
Researchers of the campaign described it as “one of the most widespread campaigns the zLabs threat research team has witnessed in 2021.” The researchers estimated that the GriftHorse gang is currently making between £1 million to £3 million per month from their scheme. Zimperium contacted Google about all the GriftHorse infected apps and they have since been removed from the Play Store.