A 10-month Android malware campaign has used nearly 250 fake apps to sign victims up to premium services on their mobile bills, with hardcoded operator targeting for users in Malaysia, Thailand, Romania and Croatia. According to new analysis from Zimperium's zLabs research team, the operation, dubbed Premium Deception by the mobile security company, ran from March 2025 to mid-January 2026. Portions of the infrastructure remain online at the time of publication. The fake apps impersonate widely recognized brands, including Facebook Messenger, Instagram Threads, TikTok, Minecraft and Grand Theft Auto. Three Variants, One Goal zLabs identified three malware variants of escalating sophistication. The most advanced, deployed against Malaysian DiGi subscribers, automated the entire subscription…