Shobhit Mishra

LSPosed, a powerful framework for rooted Android devices, has been weaponized by attackers to remotely inject fraudulent SMS messages and spoof user identities in modern payment ecosystems. This report exposes a critical vulnerability: the exploitation of LSPosed modules to intercept and modify sensitive system APIs, enabling precise identity theft and unauthorized financial transactions. It reveals the devastating potential of this technique for large-scale payment fraud and identity takeover.

CloudSEK’s latest report highlights a major shift in mobile financial fraud, where threat actors use the LSPosed framework to manipulate Android at runtime and bypass UPI SIM-binding security without altering legitimate payment apps. The technique enables remote SMS injection, identity spoofing, OTP interception, and real-time account takeover at scale. The report urges banks to adopt stronger device integrity checks and carrier-side validation to counter this evolving threat.