The disguised apps use WebView automation, JavaScript injection, and OTP interception to avoid detection and complete fraudulent subscriptions.
Android 14/13
Vulnerability
Dark Reading
Apply vendor security patch