Malware

Joker

Also known asBread

Joker is an Android trojan family active since at least 2017 that is primarily used for toll fraud and unauthorized premium-service subscriptions. It has repeatedly been embedded in functional, legitimate-looking applications distributed through Google Play, including wallpaper, messaging, utility, photography, and personalization apps. Joker commonly uses staged, dynamically loaded DEX, JAR, or APK payloads, encryption, obfuscation, packers, and conditional activation based on SIM country or mobile-network information to evade application review and analysis.

Once activated, Joker communicates with command-and-control infrastructure to obtain configuration, payloads, and jobs. It can collect SMS messages, contacts, device information, and notification-delivered verification codes. Variants automate premium WAP and carrier-billing flows in hidden WebViews, manipulate subscription webpages through JavaScript bridges, process authorization messages, and send premium SMS messages. Notification-listener functionality may be used both to obtain one-time codes and to suppress billing-related alerts. Joker has targeted users across selected European and Asian countries, among others; individual variants have been tailored to particular mobile operators. Public reporting does not conclusively attribute the family to a specific operator or state actor.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The malware also receives dynamic code and commands over HTTP and runs that code via JavaScript-to-Java callbacks.

T1059.007JavaScriptEvidence1

Because it implements a JS bridge with JavascriptInterface, it has the ability to run JS code. The commands are passed from the C&C.

Privilege Escalation

1 technique

T1548Abuse Elevation Control MechanismEvidence1

To realize the ability of subscribing app users to premium services without their knowledge or consent, the Joker utilized two main components – the Notification Listener service that is part of the original application...

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence2

It continues to find new tricks and tactics to stay undetected by doing small changes in its code or changing the payload download techniques.

T1027.002Software PackingEvidence1

we recently noticed a new Joker malware sample on Google Play Store, which utilizes Android packers like “Tencent’s Legu” and “ijiami” packers to evade detection

T1036MasqueradingEvidence4

Users may be unaware of any compromise at first glance because the Joker malware sample is contained in a functioning app. The app promises wallpapers and delivers on that promise — the malware is an unfortunate add-on.

T1140Deobfuscate/Decode Files or InformationEvidence1

GolayEngine.lay() decrypts the 308KB payload via ChaCha20 -> GolayEngine.vcg() executes it

T1497.001System ChecksEvidence1

The malware only attacks targeted countries... the victim has to be using a SIM card from one of these countries in order to receive the second stage payload... most of the discovered apps have an additional check, which will make sure that the payload won’t execute when running within the US or Canada.

T1564Hide ArtifactsEvidence1

the actors seem to be seeking a new and effective method to hide the malware’s payload... Another notable change is that the malware now hides everything valuable, such as the fraud URL, on C&C servers.

T1620Reflective Code LoadingEvidence1

In this case, all that was needed for the malicious code to run was to read the strings, decode them from Base64, and load it with reflection.

Credential Access

1 technique

T1056Input CaptureEvidence2

it subscribes users to a WAP service without their knowledge

Discovery

2 techniques

T1082System Information DiscoveryEvidence2

and android.permission.READ_PHONE_STATE to get the SIM mobile country code. Joker is known to only run on devices with a SIM card (and only for specific SIM country codes).

T1497.001System ChecksEvidence1

Collection

3 techniques

T1005Data from Local SystemEvidence1

This malware attempts to steal SMS messages, contacts from the victim’s device

T1056Input CaptureEvidence2

it subscribes users to a WAP service without their knowledge

T1213Data from Information RepositoriesEvidence1

The final important thing worth mentioning about the Joker is the phone book contact list theft. The core component collects all numbers in the contact list and sends them over to the C&C in an encrypted form.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence4

The commands are passed from the C&C. Some of the possible commands: ... get – Send a GET request ... post – Send a POST request

T1071.001Web ProtocolsEvidence2

AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.

T1105Ingress Tool TransferEvidence3

Originally, the code that was responsible for communicating with the C&C and downloading the dynamic dex file was located inside the main classes.dex file, but now the functionality of the original classes.dex file includes loading the new payload.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

submitForm - Submit form data via post request to C&C

INDICATORS OF COMPROMISE

IOCs tracked for this family

151 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

21 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

116 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

14 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app27 days ago

hash.md5●●●●●●●●●●●●View more in app1 month ago

hash.md5●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

31 SOURCESView more in app

cert polskaNews

Sep 23, 2026

Inside a multi stage toll fraud operation targeting Poland | CERT Polska

Previously analyzed Android malware family known for abusing carrier billing; it is mentioned only as contextual comparison and is not attributed to this operation.

breakglass intelNews

Mar 12, 2026

Zero Detections: How a Rust-Compiled Joker Variant With ChaCha20 Encryption Achieved Complete AV Evasion Inside an Emoji Wallpaper App - Breakglass Intelligence - Breakglass Intelligence

Android billing fraud trojan that subscribes victims to premium services and intercepts confirmation SMS or push notifications. This variant uses a Rust-compiled native library with ChaCha20-encrypted payloads and abuses notification listener access to read OTPs, confirm subscriptions, and suppress notifications.

scworldNews

Jan 15, 2026

Fake Telegram X app infects tens of thousands of Android devices with backdoor | SC Media

The report also noted ... the reappearance of the Joker and FakeApp malware on Google Play.

zscaler threat labzNews

Jan 1, 2026

Rise of Banking Trojan Dropper in Google Play | Zscaler

...embedding such malware families as Joker, Harly, Coper, and Adfraud.

+27 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching151

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Joker

Also known asBread