Avast researchers uncovered a large-scale fraud campaign utilizing 151 Android applications named “UltimaSMS”. The threat actors disguised their apps as “discount apps, games, custom keyboards, QR code scanners, video and photo editors, spam call blockers, camera filters, and more.” The application would change its language on start to match the users, then ask for a phone number and email address to use the program. With the phone number and privileges from the operating system, the app subscribes the victim to a SMS service affiliated with the threat actor for $40 a month. In total, these apps combined have 10.5 million downloads, which likely means the campaign has profited millions of dollars. Data from Sensor Tower revealed that the countries with the most downloads include Egypt, Saudi Arabia, Pakistan, and the United Arab Emirates. The applications discovered by Avast have since been removed from the Google Play store and victims have been urged to uninstall the applications from their Android device. To cancel the subscriptions, victims must contact their cell carrier and cancel the SMS subscription.