SMS-Eye (provisional)
Malware family · 1 sample(s) · 1 indicator record(s) · 1 signing certificate(s) · Active 2025-06-13 (experimental)
About SMS-Eye (provisional)
SMS-Eye (provisional) is an Android OTP/SMS stealer: it requests SMS read/receive access and silently forwards incoming messages (one-time passcodes, banking and 2FA texts) to its operator at kkkwork.org. Minimal UI, built to monetize intercepted verification codes. Provisional label pending correlation to a named family.
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| kkkwork.org/online/devices | domain | b44270b7f7d5… | 2025-06-13 |