Weaponizing LSPosed Remote SMS Injection and Identity Spoofi...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.cloudsek.com/blog/weaponizing-lsposed-remote-sms-injection-and-identity-spoofing-in-modern-payment-ecosystems-2
• Blog Title: Weaponizing LSPosed: Remote SMS Injection and Identity Spoofing in Modern Payment Ecosystems
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting -> (new) LSPosed/Xposed Hooking Attacks (Telephony/SMS API spoofing, suppressing SMS send, SMS Provider injection) or extend existing Frida/Hooking pages with an LSPosed/Xposed subsection

🎯 Content Summary

Title/Context (March 17, 2026)
CloudSEK documents a modern Android fraud technique that evolves from repacked/modified APKs to runtime environment manipulation using LSPosed on rooted devices. The attacker-controlled LSPosed module (named “Digital Lutera” at the time of the report) “gaslights” the OS by hooking system APIs that banking/payment apps rely on, while keeping the target payment app unmodified on disk (so the APK signature remains v...

🔧 Technical Details

1. Bypass SIM-binding by splitting “token generation” from “carrier-stamped SMS sending”
   If an onboarding flow matches a token received over the internet (e.g., /bindDevice) with the same token received via SMS, a fraud chain can succeed by (a) stealing/suppressing the outgoing binding SMS from the attacker device, (b) exfiltrating the token (e.g., to Telegram), and (c) commanding a separate victim-controlled device (with the real SIM) to send TDL TRB [Token] so the carrier header is stamped with the victim MSISDN. The backend sees a valid (MSISDN, Token) pairing even though the app session is running elsewhere.
   
   2) Use LSPosed/Xposed runtime hooks to defeat telephony identity checks without modifying APKs
   On rooted devices, an LSPosed module can hook Java telephony APIs such as TelephonyManager.getLine1Number() and SubscriptionInfo.getNumber() to always return an attacker-controlled MSISDN (...

🤖 Agent Actions

Summary

• Added a new LSPosed/Xposed telephony/SMS hooking abuse section (SMS suppression, MSISDN spoofing, SMS provider injection) and linked the CloudSEK blog as a reference.

Files Updated

• src/mobile-pentesting/android-app-pentesting/android-anti-instrumentation-and-ssl-pinning-bypass.md

Tests

• Not run (not requested).

If you want, I can also add a short cross-link from src/mobile-pentesting/android-app-pentesting/README.md to this section for discoverability.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.cloudsek.com/blog/weaponizing-lsposed-remote-sms-injection-and-identity-spoofing-in-modern-payment-ecosystems-2

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting -> (new) LSPosed/Xposed Hooking Attacks (Telephony/SMS API spoofing, suppressing SMS send, SMS Provider injection) or extend existing Frida/Hooking pages with an LSPosed/Xposed subsection".

Repository Maintenance:

• MD Files Formatting: 954 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0