The so-called toll fraud method uses the ancient Wireless Application Protocol (WAP) protocol that connects you to the mobile Internet and that your carrier uses to charge you for legitimate services like Spotify or even HBO Max.
Alternatively, you just pay without looking and the scam goes on for months. The Android malware is written in a way that it will look like an average service to the unsuspicious user, hiding behind unnecessary permissions.
If an app that is designed to do something totally unrelated asks for text messaging permissions, say the researchers, this should immediately raise your level of suspicion. The best way to avoid the new toll fraud Android malware, says Microsoft, is simply to run a phone with Android 10 or later.
Up until Android 9, these types of apps could skirt away undetected so if you are running an older Android version, you’d better update your phone, or if there isn’t any update for it anymore, at least install some sort of security application on it.
