The new Joker malware web page is a malicious landing page that serves an Android dropper, which then installs the Joker (also called Bread) trojan on the phone. The page poses as a video player, game mod, or PDF viewer, and nothing installs until the visitor taps the download button and allows installs from unknown sources.
These pages sit outside Google Play, which is the point. Store review has blocked Joker samples in the past. A web page has no review at all.
What does the new Joker web page look like?
A typical page carries one large download button, a short fake description, and a screenshot lifted from a real app. The button points to an APK file hosted on a cheap or compromised server. Some pages read the browser user agent and show a blank page to desktop visitors, so only phones receive the payload.
Traffic arrives through SMS and WhatsApp messages, short links, malvertising, and search results for app names. Operators rotate domains, so a page linked in a message last week can go dark while a copy appears on a new host.
Why the page matters more than the app
Earlier Joker campaigns relied on apps published to Play with a clean first version that turned malicious after an update. The web page route cuts that step out. The operators control the file, the update, and the takedown timeline.
How the Joker dropper chain works
- The page serves an APK. It is small, often under 5 MB, and sometimes disguised as an update for a system app.
- Android prompts the user to allow installs from the browser or file manager. Many users tap through without reading.
- The app opens and asks for SMS permissions, notification access, or accessibility access. Each request comes with a plausible excuse about verification or battery saving.
- A second-stage payload is decrypted and loaded at runtime as a dex file. Static scanners that only check the installed APK miss it.
- The malware contacts its command-and-control server, pulls a config, and starts the fraud routine.
What Joker does once it is running
Joker's core business is premium SMS and WAP billing fraud. The malware opens subscription pages in a hidden web view, clicks through the confirmation, and then blocks or deletes the incoming billing SMS so the user never sees the charge.
- Signs the number up for recurring premium services billed through the carrier.
- Reads and hides SMS, including one-time codes from banks and other services.
- Collects contacts, device identifiers, and the list of installed apps.
- Pulls extra modules from the server, so the feature set can change after install.
Carrier billing is the payment rail here. That is why the charges land on a phone bill instead of a card statement, and why prepaid users lose airtime balance instead of seeing an invoice.
How do you know if your phone has Joker?
- Small charges from shortcodes on the phone bill, often a few dollars a week.
- Confirmation texts for subscriptions you never started.
- An app in Settings that you do not remember installing, sometimes with no icon in the app drawer.
- SMS from banks or delivery services that never arrive.
- Battery drain and data use that climb after a new install.
How do you remove it?
- Open Settings, then Apps, and sort by install date. Look for anything you cannot place.
- Check which apps hold SMS and accessibility permissions. A game or video player has no reason to hold either.
- Run Google Play Protect from the Play Store menu and review what it flags.
- Uninstall the app, reboot, and scan again, since a dropper can reinstall itself from a downloaded file.
- Delete stray APK files in the Downloads folder.
- Call the carrier, block premium SMS on the line, and dispute the charges.
- Change the Google account password and turn on two-factor authentication.
How do you avoid these pages?
Install apps from Play or another store with review, and skip APKs from links in messages. The "install unknown apps" permission is the switch that makes this attack work, so keep it off for browsers and messaging apps.
Play Protect is on by default on most devices and scans sideloaded files, but it is a filter, not a wall. Joker samples have reached Play before, and the web page route skips the scan until the file lands on the phone.
Common questions about Joker malware
Is the Joker web page dangerous on a desktop or an iPhone?
No. Joker is an Android trojan, and the payload is an APK that iOS and desktop systems cannot install. The page can still run a phishing form, so close it and do not enter credentials.
Does Joker steal card numbers?
Joker's documented focus is SMS fraud and data collection, not card skimming. A dropper that pulls modules from a server can add features later, and the SMS access it already holds is enough to intercept bank one-time codes. Treat an infected phone as compromised.
Does a factory reset remove Joker?
A factory reset wipes the installed payload from the device. The premium subscriptions live on the carrier side, so cancel them with the carrier as well or the charges continue.
Is Joker still active?
Yes. Researchers have tracked Joker since 2017, and new samples keep appearing under fresh names and new hosting. Web page delivery is the current front end, not a one-off event.