Characterizing Malware-as-a-Service-Oriented Android Fraud Campaigns Targeting Brazil - Damasceno, José Renan F.; Bastos, Carlos Adriel Sousa; Pereira, Francisco Lucas Falcão; Rodrigues, Emanuel Bezerra; Rego, Paulo Antonio Leal (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Android fraud campaigns increasingly exhibit Malware-as-a-Service (MaaS)-oriented operational practices, including reusable delivery infrastructures, staged payload workflows, and backend-supported malware capabilities. This paper presents an exploratory characterization of Brazilian-targeting Android fraud campaigns through the analysis of phishing delivery infrastructures, malware behavior, and operational artifacts. Using OSINT-driven infrastructure discovery, static analysis, DEX-centric reverse engineering, and dynamic execution on physical devices across six real-world Android malware samples, we identified recurring patterns involving fake Google Play-style delivery pages, APK sideloading, PT-BR localized social engineering, Accessibility Services abuse, WebView-supported phishing interactions, staged payload delivery, C2 communication, and anti-analysis mechanisms. The campaigns ranged from phishing-oriented applications to more intrusive malware implementing overlay-capable flows, remote backend communication, and NFC/EMV payment-card interaction capabilities. Cross-sample correlation revealed partially shared protocol logic, reused delivery workflows, and overlapping operational artifacts, suggesting MaaS-oriented development and deployment practices in Brazilian-targeting Android fraud operations.