June's Dark Gift: The Rise of Qwizzserial

Introduction

This research uncovers the previously unknown family of Android SMS stealers that was identified along with some others during our previous investigation on Ajina. This family is named Qwizzserial after the common Java package name for its main activity component shared across samples with different Android package names.

SMS stealers pose a serious threat in Uzbekistan, as SMS remains a primary channel to interact with end users. Local payment systems are reliant on SMS to deliver two-factor authentication (2FA) codes for confirmation, including:

• P2P-transfers
• Payments for goods and services
• Adding a card to payment applications
• Authorization confirmations

This is the only security layer in most transactions in the absence of 3D Secure or biometrics. The implication of the reliance of payment systems on SMS authentication means that fraudsters can intercept the SMS, and give them control over the victim’s finances.

Key discoveries in the blog

• Distribution vector for the Qwizzserial Android SMS stealer is Telegram.
• Qwizzserial campaign mirrors Classiscam’s structure.
• The Qwizzserial stealer infected around 100,000 users, primarily in Uzbekistan.
• Resulting financial losses are at least US$62,000.
• Detailed technical analysis of the Qwizzserial Android SMS stealer.

Who may find this blog interesting:

• Cybersecurity analysts
• Fraud analysts
• Malware researchers and reverse engineers
• Threat intelligence analysts and specialists
• Law enforcement investigators

Distribution

Telegram is one of the primary distribution vectors for this malicious application. Threat actors commonly disguise the malware under deceptive file names designed to provoke curiosity or urgency, such as “Are these your photos?”, “Presidential Support”, or titles mimicking legitimate banking apps and government services.

Figure 1. A screenshot of a deceptive message via Telegram requesting users to download a malicious app to receive financial assistance from the government in Uzbek (top) and translation in English (bottom).

Figure 2. Another example of a deceptive message via Telegram requesting users to download a malicious app to receive financial assistance from the government in Uzbek (top) and translation in English (bottom).

To further enhance their credibility and to lure victims, fraudsters often create Telegram Channels posing as official government entities and officials, exploiting public trust to increase infection rates. As an example – “Moliyaviy Yordam” Telegram Channel.

Figure 3. A screenshot in Uzbek (left) and translations in English (right) of the contents that the fraudsters publish on the Telegram channel, with instructions on how to receive financial assistance.

Adversaries also publish fake decrees allegedly issued by the government authorities, to garner greater attention and amplify the reach of their malicious campaigns.

Figure 4. A falsified Presidential decree shared by fraudsters via Telegram as a way of enhancing credibility of their scam.

Inside the scheme

Further investigation revealed that this operation is structured similarly to the well-known Classiscam scheme, involving administrators, Telegram bots, and workers, but with a key difference: instead of distributing classic phishing links, the fraudsters pivoted towards creating and spreading malicious APK stealers. Telegram bots play a central role in this ecosystem, being used to generate the malicious applications and to grant access to internal group chats, and team coordination channels.

Similar to the Classiscam setup, this campaign features multiple organized communication layers: a general information channel, a Profit Channel that displays the fraudsters’’ earnings to motivate other its workers, and a main group chat comprising various roles, including workers, malware developers, vbivers—verifiers of the stolen card details and further withdrawal—and supporters who assist newcomers with onboarding and share operational tips.

Figure 5. A screenshot of the earnings published by the fraudsters on their Telegram channel in Uzbek (left) and translation in English (right).

Detailed information about Classiscam is available in our previously published technical blogs:

• Inside Classiscam
• Unmasking the Classiscam in Central Asia

Discovered in one of the threat actors groups operating as the Classiscam scheme, the Telegram Bot allows workers to generate APK files (Qwizzserial variants) for further distribution.

To generate a malicious application, the Telegram bot receives the necessary data from the worker, such as the image that will be used for the APK logo, and name for the APK.

Figure 6. A screenshot of the resulting customized APK created by the Telegram bot for the worker, after receiving information about the desired APK name and logo.

Impact

During the course of the investigation, Group-IB’s Threat Intelligence and Fraud Protection analysts tracked a single group that reaped approximately US$62,000 within three months—from mid-March to mid-June 2025—based on the information shared by the threat actors in the “Profits” channel on Telegram.

Figure 7. A diagram illustrating the profits made by a single group between mid-March to mid-June 2025, derived from the data published by the fraudsters on Telegram.

The total number of infections is approximately 100,000, distributed across around 1,200 Qwizzserial samples. Based on Group-IB’s telemetry, new samples are emerging at an increasing daily rate, as shown on the graph below.

Figure 8. A chart depicting the timeline of growth of new Qwizzserial samples.

The distribution of infections per Qwizzserial sample, shown on the graph below, follows a Pareto pattern: approximately 25% of the samples account for 80% of infections—a classic 80/20 effect.

Figure 9. A chart illustrating the distribution of infections per Qwizzserial sample.

Among the samples that Group-IB analysed, the ones that were masquerading as financial institutions saw the highest distribution rate compared to the rest of the Qwizzserial samples, resulting in more than a thousand infections.

Samples Analysis

Baseline Analysis

The first publicly available sample detected by the Group-IB Fraud Protection system (SHA1: 0ff0182805e573533646992496d7b28602e9121d) disguises itself as “Moliyaviy Yordam” which translates from Uzbek as “Financial Assistance”. This sample’s code, written in Kotlin and not obfuscated, is straightforward to analyze.

Upon its launch, the malware requests the following permissions related to phone calls and SMS messages:

The malware will repeat this request until the user grants it permission. Once the user grant permission, the user is prompted to enter two phone numbers, and a bank card number along with its expiration date.

Figure 10. A screenshot of the malware’s main activity layout in Uzbek (left) and translations in English (right), requesting for users to provide their personal and financial information.

Once the victim submits the data, the malware exfiltrates it in the background using the Telegram Bot API. Simultaneously, the screen changes to display a deceptive message:

Figure 11. A screenshot of the app after the user inputs their personal and financial information in Uzbek (left) and in English translation (right).

If the malware is launched for the first time, it also exfiltrates the following additional data:

• A randomly generated user ID
• SMS messages
• A list of installed Uzbek financial applications
• The phone number of the default SIM card
• The Service Provider Name (SPN) of the provider of the default SIM card
• MCC and MNC codes of the provider of the default SIM card
• The ISO-3166-1 alpha-2 country code for the default SIM card’s provider
• The default SIM card’s state (e.g. ready, network locked)
• The name of “associated worker”

SMS messages are exfiltrated as a ZIP archive. This archive contains three plain-text files: one for inbox messages, one for sent messages, and one for all other messages, as illustrated below:

Figure 12. Creation of the ZIP archive with SMS messages.

During the SMS message collection, the malware uses the regular expression below to check for messages related to bank account balances. If a match is found, it sends a corresponding flag.

Figure 13. The malware checks for balance-related SMS messages.

Concurrently, the malware performs an Unstructured Supplementary Service Data (USSD) request in the background via the default SIM card to retrieve the phone number. The specific USSD command depends on the default SIM card’s SPN. It uses five hardcoded USSD commands, all specific to Uzbekistan.

Beyond the initial data collection, Qwizzserial can intercept all new incoming messages using a broadcast receiver declared in manifest. For each new message, it exfiltrates the sender’s address and the message body. Furthermore, it uses the regular expression shown below to check if the received message mentions a sum exceeding 500,000 UZS (approximately US$38-39 at the time of writing):

Figure 14. The malware checks for large sums in SMS messages.

All the data described above is exfiltrated using Telegram bots to four distinct chats, each designated for a specific message type:

• Bank card information
• Initial data collected on first application launch
• New SMS message
• New SMS message with a large sum received

The described sample is considered to be in an active development stage, as evidenced by multiple non-registered implementations for the SMS receiver, as shown below.

Figure 15. Multiple SMS receiver implementations.

Tracking Changes

The latest sample at the moment of writing (SHA1: 773c72f9759dd2d38096ea57d3d236175942bfc4) disguises itself as a generic “Video” application.

This sample, like other recent ones, is obfuscated using NP Manager and the Allatori Demo version.

Figure 16, Manifest artifacts indicating the use of NP Manager.

Figure 17. An example of code obfuscated using the Allatori Demo version.

The recent samples also include unused Java packages NPStringFog and NPProtect, suggesting potential future use.

Figure 18. The unused NPStringFog and NPProtect found within the sample.

Another notable change is improved persistence. The malware prompts the user to disable battery optimization restrictions, allowing it to run continuously in the background, as shown below.

Figure 19. The screenshot of the malware requests to disable battery optimization restrictions, and corresponding code.

Instead of directly requesting card data after permissions are granted, the latest versions display an infinite preloader with a “Continue” button. This suggests fraudsters now rely on accessing card details via banking apps using compromised credentials—phone numbers and OTPs—to streamline the initial interaction.

Figure 20. The new MainActivity layout in the newly discovered versions of the Qwizzserial malware, that displays an infinite preloader.

Data exfiltration was also changed in the later versions. The malware now sends data to a gate server (hxxp://llkjllj[.]top) via HTTP POST requests, rather than directly to the Telegram API. Despite this, the messages are still routed to Telegram Bots, and the worker’s Telegram Peer ID is embedded in the sample. The malware uses the following paths:

• /log/launch: For initial data collected on first application launch
• /log/sms: For new SMS messages
• /log/ussd: For USSD responses

Figure 21. Implementation of the new exfiltration method via a gate server.

Prevention

Group-IB constantly improves its malware detection methods and provides adaptive and up-to-date protection for Group-IB customers

For Qwizzserial samples:

Group-IB specialists have identified unique properties of the Qwizzserial malware family. This allows unambiguous detection of all its samples including ones unseen before. This approach allows Group-IB to completely eliminate the damage caused by Qwizzserial for Group-IB’s customers by reacting to the threat immediately, disrupting fraudsters activity.

Figure 24. A screenshot of Qwizzserial detection in Group-IB Fraud Protection system

For new and unexplored families of sms stealers:

The Group-IB Fraud Protection system effectively detects new and previously unseen SMS-stealers. For such cases Group-IB leverages signature-agnostic rules, focusing on malicious behaviors. I.e. it highlights any sideloaded application requesting SMS reading permissions. This approach helps customers to react in advance to a possible threat.

Figure 25. A screenshot of generic SMS stealer detection in Group-IB Fraud Protection system

Group-IB Fraud Protection has an extensive and continuously growing database of malware. This data set not only allows the detection of known malware, but also supports  deep and sophisticated research to identify new trends, families, threats leading to more effective fraud prevention methods.

Conclusion

In conclusion, the Qwizzserial Android SMS stealer is a still growing threat. This case highlights that SMS stealers remain a relevant danger for Uzbek users. Their continued effectiveness is primarily due to the local banking sector’s reliance on SMS authentication.

This campaign shows how Classiscam-style operations are evolving. Threat actors are constantly adjusting their tactics to keep up with changes in user habits, security measures, and platform policies. Instead of using phishing links, they now spread malicious APK files through Telegram – making the process more efficient, harder to trace, and easier for new cybercriminals to join in.

Recommendations

To protect against Qwizzserial and other mobile stealers, we advise end-users and businesses to apply the following risk mitigation recommendations.

For Businesses

• Awareness campaigns for end users educate them about security best practices, such as recognizing phishing attempts.
• Deploy a user session monitoring system such as Fraud Protection to detect infected devices, unusual account activity and logins from suspicious devices.
• Utilize Threat Intelligence services to ensure continuous monitoring of active and evolving malware campaigns.

For End-Users

• Do not install applications shared via messengers, instead download applications only from trusted sources.
• Carefully review permissions, avoiding access to sensitive features like SMS, accessibility services, or device admin rights when justified by the app’s purpose.
• Beware of offers that seem too lucrative or implausible.

Fraud Matrix

Get Started with Fraud Matrix

If you are not yet registered in our system, we invite you to do so.

For clients using the Fraud Protection system, registration is available via the following link.

For all other interested parties, more information and a contact form are available on the following page.