{"id":90124,"date":"2018-06-27T18:33:34","date_gmt":"2018-06-28T01:33:34","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=90124"},"modified":"2025-08-19T08:40:05","modified_gmt":"2025-08-19T15:40:05","slug":"android-users-mobile-billing-fraud-due-to-sonvpay-malware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/android-users-mobile-billing-fraud-due-to-sonvpay-malware\/","title":{"rendered":"Android Users Hit With Mobile Billing Fraud Due to Sonvpay Malware"},"content":{"rendered":"

Ever hear \u201cDespacito\u201d on the radio? Of course you did! It was the song of 2017 \u2013 taking over radios, dance clubs, and even ringtones on our cell phones. Take Android users for instance \u2013 many even downloaded the \u201cDespacito for Ringtone\u201d so they could enjoy the tune anytime they received a phone call. But what they didn\u2019t know is that they could be involved in a cyberattack, rather than just listening to their favorite song. As a matter of fact, our McAfee Mobile Research team has found<\/a> a new malicious campaign, named Sonvpay, that\u2019s impacted at least 15 apps published on Google Play \u2013 including that Despacito app.<\/p>\n

How it works <\/strong><\/h2>\n

You know how with some of your apps you can adjust the push notifications? Sometimes these notifications pop up on your screen, and other times you won\u2019t receive any \u2013 depending on your settings. To enact its malicious scheme, Sonvpay listens for incoming push notifications that contain the data they need in order to perform mobile billing fraud \u2013 which is when extra charges get added to a user\u2019s phone bill and can potentially line a cybercriminal\u2019s pocket.<\/p>\n

Once receiving the data, the crooks can perform this mobile billing fraud (either WAP and SMS fraud) by displaying a fake update notification to the user. This fake notification has only one red flag \u2013 if the user scrolls until the end, the phrase \u201cClick Skip is to agree\u201d appears, as seen below.<\/p>\n

If the user clicks the only button (Skip), Sonvpay will complete its mission \u2013 and will fraudulently subscribe the user to a WAP or SMS billing service, depending on the victim\u2019s country.<\/p>\n

What it affects<\/strong><\/h2>\n

So which Android applications contain Sonvpay? The McAfee Mobile Research team initially found that Qrcode Scanner, Cut Ringtones 2018, and Despacito Ringtone were carrying the Sonvpay, and Google promptly took them down once notified. But then more emerged, totaling up to 15 applications out there that contain Sonvpay, some of which have been installed over 50,000 times. These applications include:<\/p>\n

Wifi-Hostpot<\/p>\n

Cut Ringtones 2018<\/p>\n

Reccoder-Call<\/p>\n

Qrcode Scanner<\/p>\n

QRCodeBar Scanner APK<\/p>\n

Despacito Ringtone<\/p>\n

Let me love you ringtone<\/p>\n

Beauty camera-Photo editor<\/p>\n

Flashlight-bright<\/p>\n

Night light<\/p>\n

Caculator-2018<\/p>\n

Shape of you ringtone<\/p>\n

Despacito for Ringtone<\/p>\n

Iphone Ringtone<\/p>\n

CaroGame2018<\/p>\n

So now the next question is \u2013 what do I do if I was one of the Android users who downloaded an application with Sonvpay? How can I avoid becoming a victim of this scam? Start by following these tips:<\/p>\n