There\u2019s an app for all the pieces these days\u2026 proper? Effectively, wanting up name data for a cellphone variety of selection is not<\/em> a type of issues, as doubtlessly hundreds of thousands of Android customers came upon after paying for app subscriptions promising simply that.<\/p>\n

The offending apps, which we named CallPhantom primarily based on their false claims, purport to supply entry to name histories, SMS data, and even WhatsApp name logs for any<\/em> cellphone quantity. To unlock this supposed characteristic, customers are requested to pay \u2013 however all they get in return is randomly generated information.<\/p>\n

Our investigation recognized 28 such fraudulent apps out there on the Google Play retailer, cumulatively downloaded greater than 7.3 million occasions. As an App Protection Alliance associate, we reported our findings to Google, which eliminated all the apps recognized on this report from Google Play.<\/p>\n

\n
Key factors of this blogpost:<\/strong><\/p>\n
\n
A brand new Android rip-off, CallPhantom, falsely claims to supply entry to name logs, SMS data, and WhatsApp name historical past for any cellphone quantity in change for fee.<\/li>\n
We recognized and reported 28 CallPhantom apps on Google Play, cumulatively downloaded greater than 7.3 million occasions.<\/li>\n
Some CallPhantom apps sidestep Google Play\u2019s official billing system, complicating victims\u2019 refund efforts.<\/li>\n<\/ul>\n<\/blockquote>\n
Investigation<\/h2>\n
In November 2025, we got here throughout a Reddit submit<\/a> discussing an app named Name Historical past of Any Quantity, discovered on Google Play. The app, proven in Determine 1, claims that it might probably retrieve the decision historical past of any cellphone quantity equipped by the person. It was revealed below the developer identify Indian gov.in<\/span>, however the app has no actual affiliation with the Indian authorities.<\/p>\n
$\"Figure$
Determine 1. Name Historical past of Any Quantity app on Google Play<\/em><\/figcaption><\/figure>\n
Unsurprisingly, our evaluation confirmed that the \u201cname historical past\u201d information offered by this app is totally fabricated \u2013 the app generates random cellphone numbers and matches them with fastened names, name occasions, and name durations, which had been embedded instantly within the code, as proven in Determine\u00a02. This faux information is then offered to victims \u2013 however solely after fee.<\/p>\n
$\"Figure$
Determine 2. Hardcoded name log information utilized by the app<\/em><\/figcaption><\/figure>\n
A screenshot of the fabricated name historical past information was even included within the app\u2019s itemizing, offered as an illustration of the app\u2019s performance, as proven in Determine\u00a03.<\/p>\n
$\"Figure$
Determine 3. Screenshots from Google Play seemingly demonstrating the fraudulent app\u2019s performance; the logs are randomly generated from hardcoded information<\/em><\/figcaption><\/figure>\n
Additional analysis revealed extra, associated apps out there on the Play Retailer \u2013 28 CallPhantom apps altogether. We reported the total set of fraudulent apps to Google on December 16^{th<\/sup>, 2025. On the time of publication, all of the reported apps have been faraway from the shop.<\/p>\n}
Regardless of visible variations, which will be seen in Determine\u00a04 and Determine\u00a05, the aim of the apps is equivalent: generate faux communication information and cost victims for entry. The desk within the Analyzed CallPhantom apps<\/a> <\/em>part lists every app together with its key particulars, together with the obtain rely.<\/p>\n
$\"Figure$
Determine 4. Examples of CallPhantom apps discovered on the Play Retailer<\/em><\/figcaption><\/figure>\n $\"Figure$
Determine 5. Examples of CallPhantom preliminary screens<\/em><\/figcaption><\/figure>\nMarketing campaign overview<\/h2>\n
The CallPhantom apps we discovered on Google Play primarily focused Android customers in India and the broader Asia\u2011Pacific area. Lots of the apps got here with India\u2019s +91 nation code preselected and assist UPI<\/a>, a fee system used primarily in India.<\/p>\n
The apps had garnered quite a few unfavorable critiques, with victims reporting that they had been scammed and by no means obtained the promised information, as will be seen in Determine\u00a06.<\/p>\n
$\"Figure$
Determine 6. Unfavourable critiques for one of many fraudulent apps<\/em><\/figcaption><\/figure>\n
It’s not clear how the apps had been distributed or promoted. Presumably, by seemingly providing perception into personal data, the scammers efficiently took benefit of individuals\u2019s curiosity. Mixed with a couple of glowing (faux) critiques, it may need appeared like an intriguing supply.<\/p>\n
CallPhantom overview<\/h2>\n
In our investigation, we recognized two fundamental clusters of those fraudulent apps.<\/p>\n
The apps within the first cluster<\/strong> comprise hardcoded names, nation codes, and templates of their code, as proven in Determine\u00a07. These are mixed with randomly generated cellphone numbers and proven to the person as partial \u201coutcomes\u201d. To view the total (faux) historical past, the sufferer has to pay.<\/p>\n
$\"Figure$ Determine 7. Code answerable for producing messages<\/em><\/figcaption><\/figure>\n
The apps within the second cluster<\/strong> ask customers to enter an e-mail deal with the place the \u201cretrieved\u201d name historical past would supposedly be delivered, as seen within the screenshots in Determine\u00a08. No information era happens till after fee; customers must pay or subscribe earlier than any e-mail would supposedly be despatched.<\/p>\n
$\"Figure$ Determine 8. CallPhantom requests the person\u2019s e-mail deal with the place name logs would supposedly be delivered<\/em><\/figcaption><\/figure>\n
Usually, CallPhantom apps have a easy person interface and don’t request any intrusive or delicate permissions \u2013 they don\u2019t must. Coincidentally, they don’t comprise any performance able to retrieving actual name, SMS, or WhatsApp information.<\/p>\n
Within the CallPhantom apps we analyzed, we noticed three totally different fee strategies used, the latter two of that are in violation of Google Play\u2019s funds coverage<\/a>.<\/p>\n
First, a few of the apps relied on subscriptions through Google Play\u2019s official billing system. That is required of apps providing in-app purchases, per Google Play\u2019s funds coverage; such purchases are lined by Google\u2019s refund safety<\/a>.<\/p>\n
Second, a few of the apps relied on funds through third-party apps that assist UPI. For these third-party fee apps, CallPhantom apps both included hardcoded URLs or fetched the URLs dynamically from a Firebase realtime database, that means the fee account might be modified at any time by the operator.<\/p>\n
Third, in some instances, fee card checkout types had been included instantly within the CallPhantom apps.<\/p>\n
Examples of the fee strategies will be seen in Determine\u00a09.<\/p>\n
$\"Figure$
Determine 9. Varied fee choices utilized by CallPhantom apps<\/em><\/figcaption><\/figure>\n
In a single case, we noticed an extra tactic used to coax the person into paying: if the person exited the app with out fee, the app displayed misleading alerts styled as new emails claiming that the decision historical past outcomes had arrived \u2013 see Determine\u00a010. Clicking the notification led straight to a subscription display screen.<\/p>\n
$\"Figure$
Determine 10. Misleading notification displayed by CallPhantom to influence customers to subscribe<\/em><\/figcaption><\/figure>\n
The charges requested for the faux service differ broadly throughout the apps. The apps additionally seem to supply totally different subscription packages, reminiscent of weekly, month-to-month, or yearly providers, with the best requested worth sitting at US$80. For the bottom \u201csubscription tier\u201d, the common requested worth was \u20ac5.<\/p>\n
What to do you probably have been scammed<\/h2>\n
Usually, subscriptions bought by the official Google Play billing system will be canceled within the Play Retailer app by tapping your profile icon, navigating to Funds & subscriptions \u2192 Subscriptions, choosing the lively subscription, and tapping Cancel subscription. Google explains the total course of on its Cancel, pause, or change a subscription on Google Play<\/a> web page.<\/p>\n
For the 28 apps described on this blogpost, present subscriptions have been canceled when the apps had been faraway from Google Play.<\/p>\n
In some instances, refunds for Google Play purchases are doable. Google might concern a refund relying on the time since buy, the kind of merchandise, and its refund coverage. Usually, requests have to be made inside the allowed refund window as described on Google\u2019s assist web page<\/a>.<\/p>\n
If the acquisition was made exterior Google Play \u2013 for instance, by coming into fee card particulars contained in the app or by paying by third\u2011celebration providers \u2013 then Google can’t cancel the subscription or concern a refund, and customers must contact the fee supplier or the app developer instantly.<\/p>\n
Conclusion<\/h2>\n
We recognized a brand new cluster of fraudulent Android apps on Google Play that collectively amassed over 7.3 million downloads earlier than being taken down upon notification by ESET. These apps, which we collectively named CallPhantom, falsely promise to retrieve name logs, SMS data, and WhatsApp name historical past for any cellphone quantity, a technically unimaginable declare designed solely to use individuals\u2019s curiosity and mislead them into paying.<\/p>\n
Lots of the apps circumvented Google Play\u2019s official billing system, pushing customers towards third\u2011celebration funds or direct card entry, complicating refund efforts and exposing victims to monetary threat.<\/p>\n
Our evaluation revealed that the \u201coutcomes\u201d proven to victims are totally fabricated, usually utilizing hardcoded Indian numbers, predefined names, and generated timestamps disguised as actual communication information.<\/p>\n
Customers who subscribed through official Google Play billing could also be eligible for refunds below Google\u2019s refund insurance policies. Purchases made through third\u2011celebration fee apps or by direct fee card entry can’t be refunded by Google, leaving customers depending on exterior fee suppliers or builders.<\/p>\n
\n
For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com<\/a>.\u00a0<\/em><\/div>\n
ESET Analysis gives personal APT intelligence studies and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence<\/a> web page.<\/em><\/div>\n<\/blockquote>\n
Analyzed CallPhantom apps <\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
App identify<\/strong><\/td>\n Package deal identify<\/strong><\/td>\n Variety of downloads<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Name historical past : any quantity deta<\/td>\n calldetaila.ndcallhisto.rytogetan.ynumber<\/span><\/td>\n 3M+<\/td>\n<\/tr>\n
Name Historical past of Any Quantity<\/td>\n com.pixelxinnovation.supervisor<\/span><\/td>\n 1M+<\/td>\n<\/tr>\n
Name Particulars of Any Quantity<\/td>\n com.app.name.element.historical past<\/span><\/td>\n 1M+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n sc.name.ofany.mobiledetail<\/span><\/td>\n 500K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.cddhaduk.callerid.block.contact<\/span><\/td>\n 500K+<\/td>\n<\/tr>\n
Name Historical past Of Any Quantity<\/td>\n com.basehistory.historydownloading<\/span><\/td>\n 500K+<\/td>\n<\/tr>\n
Name Historical past of Any Numbers<\/td>\n com.name.of.any.quantity<\/span><\/td>\n 100K+<\/td>\n<\/tr>\n
Name Historical past Of Any Quantity<\/td>\n com.rajni.callhistory<\/span><\/td>\n 100K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.callhistory.calldetails.callerids.callerhistory.callhostoryanynumber.getcall.history.callhistorymanager<\/span><\/td>\n 100K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.callinformative.instantcallhistorical past.callhistorybluethem.callinfo<\/span><\/td>\n 100K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity element<\/td>\n com.name.element.caller.historical past<\/span><\/td>\n 100K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.anycallinformation.datadetailswho.callinfo.numberfinder<\/span><\/td>\n 100K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.callhistory.callhistoryyourgf<\/span><\/td>\n 100K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity<\/td>\n com.calldetails.smshistory.callhistoryofanyquantity<\/span><\/td>\n 50K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.callhistory.anynumber.chapfvor.historical past<\/span><\/td>\n 50K+<\/td>\n<\/tr>\n
Name Historical past of Any Quantity<\/td>\n com.callhistory.callhistoryany.name<\/span><\/td>\n 50K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.identify.issue<\/span><\/td>\n 50K+<\/td>\n<\/tr>\n
Name Historical past Of Any Quantity<\/td>\n com.getanynumberofcallhistory.callhistoryofanynumber.findcalldetailsofanynumber<\/span><\/td>\n 50K+<\/td>\n<\/tr>\n
Name Historical past Of Any Quantity<\/td>\n com.chdev.callhistory<\/span><\/td>\n 10K+<\/td>\n<\/tr>\n
Telephone Name Historical past Tracker<\/td>\n com.cellphone.name.historical past.tracker<\/span><\/td>\n 10K+<\/td>\n<\/tr>\n
Name Historical past- Any Quantity Deta<\/td>\n com.pdf.maker.pdfreader.pdfscanner<\/span><\/td>\n 10K+<\/td>\n<\/tr>\n
Name Historical past Of Any Quantity<\/td>\n com.any.numbers.calls.historical past<\/span><\/td>\n 10K+<\/td>\n<\/tr>\n
Name Historical past Any Quantity Element<\/td>\n com.callapp.historyero<\/span><\/td>\n 1K+<\/td>\n<\/tr>\n
Name Historical past – Any Quantity Knowledge<\/td>\n all.callhistory.element<\/span><\/td>\n 500+<\/td>\n<\/tr>\n
Name Historical past For Any Quantity<\/td>\n com.easyranktools.callhistoryforanynumber<\/span><\/td>\n 100+<\/td>\n<\/tr>\n
Name Historical past of Numbers<\/td>\n com.sbpinfotech.findlocationofanynumber<\/span><\/td>\n 100+<\/td>\n<\/tr>\n
Name Historical past of Any Quantity<\/td>\n callhistoryeditor.callhistory.numberdetails.calleridlocator<\/span><\/td>\n 50+<\/td>\n<\/tr>\n
Name Historical past Professional<\/td>\n com.all_historydownload.anynumber.callhistorybackup<\/span><\/td>\n 50+<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
IoCs<\/h2>\n
A complete record of indicators of compromise (IoCs) and samples will be present in our GitHub repository<\/a>.<\/p>\n
Information<\/h3>\n
<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
SHA-1<\/strong><\/td>\n Filename<\/strong><\/td>\n Detection<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
799BB5127CA54239D3D4A14367DB3B712012CF14<\/span><\/td>\n all.callhistory.detail.apk<\/span><\/td>\n Android\/CallPhantom.Okay<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
56A4FD71D1E4BBA2C5C240BE0D794DCFF709D9EB<\/span><\/td>\n calldetaila.ndcallhisto.rytogetan.ynumber.apk<\/span><\/td>\n Android\/CallPhantom.M<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
EC5E470753E76614CD28ECF6A3591F08770B7215<\/span><\/td>\n callhistoryeditor.callhistory.numberdetails.calleridlocator.apk<\/span><\/td>\n Android\/CallPhantom.F<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
77C8B7BEC79E7D9AE0D0C02DEC4E9AC510429AD8<\/span><\/td>\n com.all_historydownload.anynumber.callhistorybackup.apk<\/span><\/td>\n Android\/CallPhantom.G<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
9484EFD4C19969F57AFB0C21E6E1A4249C209305<\/span><\/td>\n com.any.numbers.names.historical past.apk<\/span><\/td>\n Android\/CallPhantom.L<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
CE97CA7FEECDCAFC6B8E9BD83A370DFA5C336C0A<\/span><\/td>\n com.anycallinformation.datadetailswho.callinfo.numberfinder.xapk<\/span><\/td>\n Android\/CallPhantom.B<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
FC3BA2EDAC0BB9801F8535E36F0BCC49ADA5FA5A<\/span><\/td>\n com.app.name.element.historical past.apk<\/span><\/td>\n Android\/CallPhantom.N<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
B7B80FA34A41E3259E377C0D843643FF736803B8<\/span><\/td>\n com.basehistory.historydownloading.xapk<\/span><\/td>\n Android\/CallPhantom.O<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
F0A8EBD7C4179636BE752ECCFC6BD9E4CD5C7F2C<\/span><\/td>\n com.name.element.nameer.historical past.xapk<\/span><\/td>\n Android\/CallPhantom.C<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
D021E7A0CF45EECC7EE8F57149138725DC77DC9A<\/span><\/td>\n com.name.of.any.number.apk<\/span><\/td>\n Android\/CallPhantom.Q<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
04D2221967FFC4312AFDC9B06A0B923BF3579E93<\/span><\/td>\n com.callapp.historyero.apk<\/span><\/td>\n Android\/CallPhantom.E<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
CB31ED027FADBFA3BFFDBC8A84EE1A48A0B7C11D<\/span><\/td>\n com.calldetails.smshistory.callhistoryofanynumber.apk<\/span><\/td>\n Android\/CallPhantom.Q<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
C840A85B5FBAF1ED3E0F18A10A6520B337A94D4C<\/span><\/td>\n com.callhistory.anynumber.chapfvor.history.xapk<\/span><\/td>\n Android\/CallPhantom.J<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
BB6260CA856C37885BF9E952CA3D7E95398DDABF<\/span><\/td>\n com.callhistory.nameparticulars.callerids.callerhistory.callhostoryanynumber.getcall.historical past.callhistorysupervisor.apk<\/span><\/td>\n Android\/CallPhantom.S<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
55D46813047E98879901FD2416A23ACF8D8828F5<\/span><\/td>\n com.callhistory.namehistoryany.name.apk<\/span><\/td>\n Android\/CallPhantom.T<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
E23D3905443CDBF4F1B9CA84A6FF250B6D89E093<\/span><\/td>\n com.callhistory.namehistoryyourgf.apk<\/span><\/td>\n Android\/CallPhantom.D<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
89ECEC01CCB15FCDD2F64E07D0E876A9E79DD3CE<\/span><\/td>\n com.callinformative.instantcallhistory.callhistorybluethem.callinfo.xapk<\/span><\/td>\n Android\/CallPhantom.B<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
8EC557302145B40FE0898105752FFF5E357D7AC9<\/span><\/td>\n com.cddhaduk.callerid.block.contact.xapk<\/span><\/td>\n Android\/CallPhantom.U<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
6F72FF58A67EF7AAA79CE2342012326C7B46429D<\/span><\/td>\n com.easyranktools.callhistoryforanynumber.apk<\/span><\/td>\n Android\/CallPhantom.H<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
28D3F36BD43D48F02C5058EDD1509E4488112154<\/span><\/td>\n com.getanynumberofcallhistory.callhistoryofanynumber.findcalldetailsofanynumber.xapk<\/span><\/td>\n Android\/CallPhantom.D<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
47CEE9DED41B953A84FC9F6ED556EC3AF5BD9345<\/span><\/td>\n com.chdev.callhistory.xapk<\/span><\/td>\n Android\/CallPhantom.V<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
9199A376B433F888AFE962C9BBD991622E8D39F9<\/span><\/td>\n com.identify.issue.apk<\/span><\/td>\n Android\/CallPhantom.P<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
053A6A723FA2BFDA8A1B113E8A98DD04C6EEF72A<\/span><\/td>\n com.pdf.maker.pdfreader.pdfscanner.apk<\/span><\/td>\n Android\/CallPhantom.W<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
4B537A7152179BBA19D63C9EF287F1AC366AB5CB<\/span><\/td>\n com.cellphone.name.history.tracker.apk<\/span><\/td>\n Android\/CallPhantom.I<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
87F6B2DB155192692BAD1F26F6AEBB04DBF23AAD<\/span><\/td>\n com.pixelxinnovation.supervisor.apk<\/span><\/td>\n Android\/CallPhantom.X<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
583D0E7113795C7D68686D37CE7A41535CF56960<\/span><\/td>\n com.rajni.callhistory.apk<\/span><\/td>\n Android\/CallPhantom.Y<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
45D04E06D8B329A01E680539D798DD3AE68904DA<\/span><\/td>\n com.sbpinfotech.discoverlocationofanynumber.xapk<\/span><\/td>\n Android\/CallPhantom.A<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n
34393950A950F5651F3F7811B815B5A21F84A84B<\/span><\/td>\n sc.name.ofany.cellelement.apk<\/span><\/td>\n Android\/CallPhantom.Z<\/td>\n Android CallPhantom.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/span><\/h3>\n
Community<\/h3>\n\n\n\n\n\n\n
IP<\/strong><\/td>\n Area<\/strong><\/td>\n Internet hosting supplier<\/strong><\/td>\n First seen<\/strong><\/td>\n Particulars<\/strong><\/td>\n<\/tr>\n<\/thead>\n
34.120.160[.]131<\/span><\/td>\n \n
call-history-7cda4-default-rtdb.firebaseio[.]com<\/span><\/p>\n
call-history-ecc1e-default-rtdb.firebaseio[.]com<\/span><\/p>\n<\/td>\n
Google LLC<\/td>\n 2025\u201105\u201114<\/td>\n CallPhantom C&C server.<\/td>\n<\/tr>\n
34.120.206[.]254<\/span><\/td>\n \n
ch-ap-4-default-rtdb.firebaseio[.]com<\/span><\/p>\n
chh1-ac0a3-default-rtdb.firebaseio[.]com<\/span><\/p>\n
\u00a0<\/p>\n<\/td>\n
Google LLC<\/td>\n 2025\u201104\u201117<\/td>\n CallPhantom C&C server.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
MITRE ATT&CK methods<\/h2>\n
This desk was constructed utilizing model 18<\/a> of the MITRE ATT&CK framework.<\/p>\n\n\n\n\n\n\n
Tactic<\/strong><\/td>\n ID<\/strong><\/td>\n Title<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Command and Management<\/strong><\/td>\n T1437.001<\/a><\/td>\n Utility Layer Protocol: Net Protocols<\/td>\n CallPhantom makes use of Firebase Cloud Messaging for C&C communication.<\/td>\n<\/tr>\n
Impression<\/strong><\/td>\n T1643<\/a><\/td>\n Generate Visitors from Sufferer<\/td>\n CallPhantom tries to attain fraudulent billing.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
$\"\"$ <\/a><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"
There\u2019s an app for all the pieces these days\u2026 proper? Effectively, wanting up name data for a cellphone variety of selection is not a type of issues, as doubtlessly hundreds of thousands of Android customers came upon after paying for app subscriptions promising simply that. The offending apps, which we named CallPhantom primarily based on […]<\/p>\n","protected":false},"author":2,"featured_media":14567,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[797,8998,4128,342],"class_list":["post-14565","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-android","tag-callphantom","tag-tricks","tag-users"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/14565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14565"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/14565\/revisions"}],"predecessor-version":[{"id":14566,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/14565\/revisions\/14566"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/14567"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14565"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

IoCs<\/h2>\nA complete record of indicators of compromise (IoCs) and samples will be present in our GitHub repository<\/a>.<\/p>\n

IoCs<\/h2>\n
A complete record of indicators of compromise (IoCs) and samples will be present in our GitHub repository<\/a>.<\/p>\n