An ongoing smishing campaign has recently been observed targeting Android and iOS users in France with the “MoqHao” (aka “XLoader” for Android) malware. This campaign is attributed to Roaming Mantis, a Chinese financially motivated threat group with a history of targeting the United States, the United Kingdom, Japan, South Korea, Taiwan, and Germany. Researchers at SEKOIA.IO detailed that the campaign’s lure contains a malicious URL as well as a message about a package that must be reviewed. Once a French user clicks the link, an iOS user is redirected to an Apple credential harvesting webpage. Android users are redirected to a site that delivers the installation file for a malicious Android Package Kit (APK). The APK, which corresponds to the XLoader malware, then executes and mimics a Chrome installation, which prompts the user for risky permissions that allow “SMS interception, making phone calls, reading and writing storage, handling system alerts, retrieving an accounts list, and more.” The malware then communicates back to the main command-and-control (C2) server. In order to bypass detection, the C2 configuration is retrieved from hardcoded Imgur profile destinations that are encoded in base64. If a user outside France attempts either of these paths, a “404” error is shown and the attack ends. Overall, this campaign has the potential to provide Roaming Mantis with “access to data from the local system, SD card, applications, messages or contact list, iCloud backups, iMessage, call history, as well as allowing remote interaction.” Researchers also noted that approximately 90,000 unique IP addresses have requested XLoader from the hardcoded C2 server, and it is currently unknown the number of iOS users that have submitted their login credentials on the phishing webpage. A further in-depth analysis of Roaming Mantis’ smishing campaign as well as indicators of compromise (IOCs) can be viewed in SEKOIA.IO’s report linked below.