We found an app on Google Play named “Yellow Camera”, which poses as a camera and photo beautification or editing app embedded with a routine of reading SMS verification codes from the System Notifications, and, in turn, activate a Wireless Application Protocol (WAP) billing. We disclosed our findings to Google, and the app, along with related ones we saw, are no longer in the Play store.

Based on the name of the file downloaded by the app, it appears it is mostly targeting users in Southeast Asia (e.g., Thailand, Malaysia). However, we’ve also seen the app targeting Chinese-speaking users, so it won’t be a surprise if the app gradually shifts or expands targets. While the app has already been taken down in the Play store, we found that the fraudsters uploaded similar apps to the app store.