Threat researchers have observed a shift in mobile attack techniques targeting Android users in Uzbekistan, where attackers are now relying on malicious dropper applications to distribute an SMS-stealing malware known as Wonderland.
Earlier campaigns delivered straightforward malicious APKs that immediately revealed their intent once installed. That approach has largely been abandoned. Instead, attackers now push applications that appear legitimate at first glance. These droppers behave like normal apps during installation but quietly deploy an encrypted malicious payload afterward, sometimes without requiring an active internet connection.
Wonderland, which was formerly called WretchedCat when it was originally detected, is intended for use in an ongoing command-and-control implementation rather than simply stealing user data. Wonderland supports bidirectional C2 communication and allows operators to send commands to their victims in real time. In addition to being able to steal SMS messages and one-time passwords, Wonderland is able to execute arbitrary USSD requests, making it highly capable of draining bank accounts associated with mobile numbers.
To entice potential victims to install the malware, Wonderland disguises itself as trustworthy content. Several of the samples have attempted to impersonate Google Play Services as well as benign documents such as videos, photos, and wedding invitations. Once a victim has installed the malware and given it permission to access SMS messages, contact lists, and device metadata, the malware will also be able to suppress notification messages that could alert a victim that a malicious activity is occurring.
Group-IB has determined that the current operating group is financially motivated and goes by the name of TrickyWonders, which organizes its operations via Telegram. The TrickyWonders operation utilizes an extensive number of different families of droppers, with specific identifiers as follows:
1. MidnightDat (detected August 2025)
2. RoundRift (detected October 2025)
The Wonderland payload is carried by "droppers" that hide the actual malicious file inside them using encryption. The droppers are distributed via several different routes including malicious versions of Google Play, Facebook Ads, Dating Apps, and Telegram. In some cases, the criminals will use the stolen session tokens they bought from the underground markets to take over the phone number of a victim and send an infected APK directly to the victim's contact list.
To trick users into installing the malicious application, many criminals will use social engineering. For example, they may tell users that an "update" needs to be installed in order to continue using the app. This type of tactic convinces users to allow new installations from unknown sources.
When the infected application is installed on the phone, Wonderland tries to take control of the victim's Telegram account using the stolen phone number. If it is successful, the infected APK will be sent from the victim's Telegram account to all of their contacts again and again creating a loop of self-propagating infections.
Capabilities and Evolution
Wonderland is much more than just an SMS theft program. Some of its additional capabilities include: intercepting OTPs and banking alerts, extracting & exfiltration the victim's contact list and phone numbers, hiding any security notifications, sending SMS messages to continue propagating the malware.
The strategy behind dropper applications stems from separating the implementation of the payload to allow for a separation of verification or execution processes. The separation means these components will be highly obfuscated and harder to detect or analyze. By using anti-analysis techniques and encrypting the payload, the authors can delay the reverse-engineering of the application and the corresponding signature-based detection of the malware itself through low access to the application.
The operational infrastructure of this particular malware is also critical. The Command and Control (C&C) Domain Names (DNS) frequently change, and then each domain is associated with a limited number of builds. This model reduces the effects of takedown efforts and makes it more difficult to implement blacklist-based protection against these applications. To accomplish the automation of the build process, the author utilizes a Telegram bot for the automatic generation of builds and utilizes "workers" to distribute the builds after the worker has received his reward for the theft of funds.
The tiered structure of the operation includes a number of functional responsibilities assigned to various people within the operation. Developers of the malware are responsible for maintaining the malware, operators are responsible for the management of malware campaigns, and "experts" are responsible for validating that stolen credit card information has been successfully processed. This type of hierarchical organization is more representative of the level of maturity associated with large organized groups of cybercriminals rather than small gangs of fraudsters.
The Wonderland campaign signifies a broader problem
New malware families of Android malware (Cellik, Frogblight, NexusRoute) are being created and deployed increasingly easily and are now being capable of performing much larger and broader activities than ever before.
Cellik has been presented as a product on various underground sites, and in real-time, has an ability to stream the screen of the infected user, keylogger function, Remote Access to the device's camera, a builder that enables the construction of an Android package file, e.g. APK File that can be placed into a legitimate product from Google Play with very little work required.
Frogblight, seen attacking individuals in Turkey, has employed SMS Phishing messages disguised as Court notifications as a distribution method. This malware also steals banking information, collects Device information, and has evolved towards a malware as Service model.
Recently the NexusRoute was used to deliver Android malware to Indian users and did so by making use of the apparent existence of fake government service-based sites to deliver a fully hashed Remote Access Trojan (RAT) which harvests financial information, intercepts SMS messages, uses Accessibility services, and covers its tracks through Persistence (ability to maintain surveillance continually).
As a whole, these campaigns illustrate an observable trend towards; operating mobile malware has become more professional and automated, and subsequently, it is becoming more straightforward for less skilled users to operate at high volumes.
Source: The Hacker News
