Analyzing Android Malware Disguised As a Digital Wedding Invitation
It all starts with a polite message.
A familiar name, a courteous greeting, and a seemingly harmless attachment: Buka_Undangan_Resmi.pdf. Nothing looks unusual at first glance. But what if the invitation is not what it appears to be?
This is a common social engineering tactic, exploiting trust to make malicious files seem legitimate. When the message comes from someone we know, we may be even less likely to question it especially if their account has been compromised
As an Security Researcher, I obtained a sample of this file and conducted a static analysis to uncover what lies beneath its innocent appearance. In this article, i will examine its contents, investigate its suspicious mechanisms, and identify the red flags that can help us recognize similar threats.
This article is intended purely for cybersecurity education (defensive security) purposes. I am not sharing sample files, functional source code or the discovered C2 credentials. The goal is for readers to understand the attack patterns, not to replicate the attack.
First red flag: the “PDF” filename is a lie.
Upon inspection, the irregularity was immediately apparent. Although the file name ended with what looked like a PDF extension, examining its internal structure revealed it to be an Android APK file ready for installation.
This is an old but effective trick, many custom Android keyboards and file managers and even WhatsApp itself do not always clearly display file extensions. A victim sees a document icon and assumes it is an ordinary PDF invitation, when in reality, what they are tapping is an app installer.
How to check this yourself (safely, without installing anything):
1. You can use VirusTotal (This is the easiest way)
2. Use the “file apk_name” command in a Linux terminal
(If the result is a ZIP archive or an Android application package, even though the filename ends in .pdf or .doc , that should immediately raise a red flag.)
By using the two methods above, you can identify the file or APK you are obtaining.
Dissecting the “inner workings” a two-stage architecture
When I unpacked the manifest (using JADX), it turned out not to be a single piece of malware, but rather two APKs operating in stages. This is a common pattern used to make antivirus detection more difficult.
Stage 1 — The “Dropper”
At first glance, this initial APK appears harmless. The only permissions it requests are:
Its task is simple, display a convincing “invitation” page and then prompt the victim to install a second APK, which is actually the brains behind the attack. This is why, during the initial installation, Android does not display any suspicious permission warnings everything appears “normal.”
Stage 2 — The Main Payload
This is where it gets interesting. The second APK requests far more aggressive permissions:
This combination of RECEIVE_SMS, READ_SMS, and SEND_SMS is the classic “signature” of an SMS stealer or OTP grabber. If you have ever wondered, “How did my OTP get intercepted when I never shared it with anyone?” the answer lies in these three lines of code.
What actually made me pause was another component in its manifest:
android:permission=”android.permission.BIND_NOTIFICATION_LISTENER_SERVICE”.
This means the malware doesn’t just read SMS messages, it can also read the content of notifications from other apps. So, even if a service sends a verification code via a push notification (rather than SMS), it can still be “stolen” through this channel. This explains why many victims lose their accounts even though they never shared their SMS OTP code with anyone.
A simple analogy for non-technical people, imagine installing a CCTV camera in your mailbox (SMS reading permission), but it turns out the same person also has a duplicate key to all the “notification boxes” on your phone (notification reading permission). They don’t need to wait for mail to arrive in the mailbox, they can peek at all the incoming “mail” coming through any entry point.
Where is this stolen data sent?
While examining some AndroidManifest.xml code, I discovered “ReceiveSms” and “SendSMS” activities. upon opening them. I found a Telegram bot URL used by the scammer.
This is the official Telegram Bot API endpoint. Attackers do not bother setting up their own command-and-control (C2) servers, they simply create a Telegram bot, and the stolen SMS data or notifications are sent directly to that bot’s chat in real time.
Why is this a clever pattern (from an attacker’s perspective) and a dangerous one (from our perspective)?
1. Cheap and quick to set up no need to rent a server or purchase a custom domain.
2. Traffic appears “normal” connections to api.telegram.org easily blend in with traffic from legitimate applications, and many network security solutions do not automatically block the Telegram domain.
3. Difficult to take down the process of reporting a bot to Telegram for suspension is much slower than taking down a custom C2 domain.
End-to-end attack flow
When pieced together, here is the complete flow of this “Wedding Invitation” attack :
- The victim receives a WhatsApp message containing a file named “undangan.pdf” (which is actually an APK dropper).
- The victim installs the app; the dropper requests permission to install another APK (appearing legitimate).
- The dropper silently installs a second APK (the main payload).
- The payload requests permissions to read SMS messages, read notifications, and access the internet.
- The malware registers itself as an `SMS_RECEIVED` listener and a `NotificationListenerService`.
- Every incoming OTP SMS or notification is automatically forwarded to the attacker’s Telegram bot.
- The attacker uses the OTP to re-register the victim’s WhatsApp account on a different device.
- The victim’s WhatsApp account is hijacked and used to resend the same invitation to all of the victim’s contacts.
It is this eighth point that causes the malware to spread like a snowball each new victim automatically becomes a “spreading vector” for their own contacts, because the messages arrive from a number they recognize.
Get Aditya Pranoto’s stories in your inbox
Join Medium for free to get updates from this writer.
Not the first instance this is a recurring pattern in Indonesia.
If this modus operandi seems familiar, that is understandable; the “Wedding Invitation” scam is merely the latest disguise for the same old trick one that has worn many faces in Indonesia over the years. What remains exactly the same in every case are the payload (requesting access to SMS messages or, at times, notifications), the distribution channel (WhatsApp, via a number that appears familiar) and the ultimate outcome (OTP theft and compromised accounts or bank accounts).
An interesting pattern to observe is that the “wedding invitation” scam has surfaced repeatedly in distinct waves since 2022 while early versions merely requested SMS access, newer variants including the sample I analyzed above have begun requiring access to notification listeners. This indicates that malware authors are continuously upgrading their payloads as public awareness regarding SMS permissions grows, marking a shift from simple “SMS stealers” to something resembling lightweight spyware.
It is also worth noting that some security research reports have documented variants of this scam employing Remote Access Trojan (RAT) malware, meaning they do not merely steal SMS messages or notifications but grant full remote control over the victim’s device. This demonstrates that the trend is not static it continues to evolve, becoming increasingly invasive over time.
Why does this pattern continue to succeed despite frequent media coverage?
- Social engineering that targets various emotions curiosity (invitations), fear of fines (traffic violations) and financial urgency (bills). Each ruse exploits a different psychological trigger consequently, generic warnings about “malicious APK files” often fail to resonate personally with someone who is currently panicked or curious.
- Distribution via compromised numbers once a victim falls prey, their contacts become the next targets, meaning messages arrive from numbers that are socially “legitimate” (known to the recipient) rather than from unknown sources.
- Low technical barriers for malware creators cases handled by authorities reveal that the creators are not necessarily large, organized groups. Malware templates or source code can reportedly be acquired or traded within limited circles at relatively low costs and then independently reused by numerous small-scale operators this explains the proliferation of variants across various regions.
How to recognize & protect yourself
- Be wary of invitation files or documents from unknown contacts, especially if the file extension looks suspicious or the size is unusually large for a “PDF” (the sample I analyzed was over 100 MB a standard digital wedding invitation PDF is rarely that big).
- Check permissions before installing, if a “wedding invitation” app requests access to SMS and notifications, that is not a reasonable requirement for simply displaying a digital invitation card.
- Disable the “Install from Unknown Sources” setting on your Android device when you don’t need it.
- Enable Two-Step Verification on WhatsApp (Settings → Account → Two-step verification) this provides a crucial layer of defense even if your SMS OTP is compromised.
- If you receive a strange message from a known contact containing an unexpected invitation file, verify it directly with that person via another channel (such as a phone call) before opening it.
So, what if you have already installed it?
- Turn on airplane mode, this prevents any SMS notifications from appearing.
- Visit the bank to temporarily block your mobile banking, this is to ensure your balance is not drained.
- Remove the SIM card from the malware-infected mobile phone and insert it into another, secure mobile phone.
- Download the Malwarebytes app from the Play Store or App Store.
- Perform a full scan using the application and wait for it to finish then, if any suspicious applications are found, delete them immediately.
- For more definitive results, perform another full scan once the results show that everything is secure, you may proceed to recover your social media and other accounts.
- All done and the mobile phone is safe again.
By following the steps above, your mobile phone should be secure again, as the second application that had been installed will have been completely removed.
If you want to try a similar analysis
For readers interested in diving into the world of malware analysis, here is the minimal toolkit I used for the analysis above all of which are free and open-source:
- Initial triage
VirusTotal : Check file hash against global AV detection databases. - Static analysis
Androguard (Python) or JADX / JADX-GUI or Mobsf: These tools can be used to analyze Android applications without running them by examining the APK, AndroidManifest.xml, and decompiled code. - Dynamic Analysis
Frida + isolated emulator : Observe application behavior at runtime without endangering the actual device.
Golden rule: always perform dynamic analysis (running the sample) within an emulator or virtual machine that is completely isolated from the production network never on a personal mobile phone and ensure there is no sensitive data whatsoever inside the emulator or VM.
Conclusion
One thing kept running through my mind as I analyzed this sample, not a single line of code in this malware is sophisticated. There are no zero-day exploits, no complex encryption techniques nothing that truly qualifies as “hacking.” It does not exploit a vulnerability in the Android system instead, it exploits trust the trust that a message from a known number is safe and the belief that a wedding invitation couldn’t possibly be malicious.
The good news is that a single moment of suspicion can save you from months of recovery. Check the file extension. Verify the message with the sender through a different channel. Never install an APK from outside the Play Store, regardless of the pretext. It takes months of malicious effort to create malware like this don’t let it succeed simply because of one hasty tap.
A compromised WhatsApp account means more than just the loss of private chats, it means your identity is being used to scam people who trust you family, friends and colleagues. Every person who lets their guard down adds another link to this cycle. Breaking that chain can start with something as simple as pausing before hitting the “install” button.
If this article helps you recognize similar patterns, please share it with family members or colleagues who may be less familiar with the technical world as they are often the most vulnerable targets for this type of social engineering attack.
