Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

Wonderland malware uses dropper applications to disguise malicious payloads within legitimate-looking apps. The malware facilitates bidirectional C2 communication for real-time command execution, SMS theft, and arbitrary USSD requests. It masquerades as Google Play or media files and is distributed via fake Play Store pages, Facebook ads, and Telegram. The operation includes MidnightDat and RoundRift dropper families. Cellik RAT offers screen streaming, keylogging, camera/microphone access, and one-click APK building. Frogblight targets Turkish users via SMS phishing and steals banking credentials using WebViews. NexusRoute uses phishing portals impersonating Indian government services and employs accessibility service abuse.