GriftHorse Android Trojan Steals Millions from Over 10 Million Victims Globally

Share this blog

Research and writeup by Aazim Yaswant and Nipun Gupta

With the increase of mobile device use in everyday life, it is no surprise to see cybercriminals targeting these endpoints for financial crimes. Zimperium zLabs recently discovered an aggressive mobile premium services campaign with upwards of 10 million victims globally, and the total amount stolen could be well into the hundreds of millions of Euros. While typical premium service scams take advantage of phishing techniques, this specific global scam has hidden behind malicious Android applications acting as Trojans, allowing it to take advantage of user interactions for increased spread and infection.

These malicious Android applications appear harmless when looking at the store description and requested permissions, but this false sense of confidence changes when users get charged month over month for the premium service they get subscribed to without their knowledge and consent.

The Zimperium zLabs researchers discovered this global premium services Trojan campaign through a rise in specific alerts from our z9 on-device malware detection engine, which detected and reported the true nature of these malicious Android applications.

Forensic evidence of this active Android Trojan attack, which we have named GriftHorse, suggests that the threat group has been running this campaign since November 2020. These malicious applications were initially distributed through both Google Play and third-party application stores. Zimperium zLabs reported the findings to Google, who verified the provided information and removed the malicious applications from the Google Play store. However, the malicious applications are still available on unsecured third-party app repositories, highlighting the risk of sideloading applications to mobile endpoints and user data and needing advanced on-device security.

Disclosure: As a key member of the Google App Defense Alliance, Zimperium scans applications before publishing and provides an ongoing analysis of Android apps in the Google Play Store.

In this blog, we will:

  • Cover the capabilities of the GriftHorse Trojan;
  • Discuss the architecture of the applications;
  • Show the communication with the C&C server; and
  • Explore the global impact of the GriftHorse campaign.

What can the GriftHorse Android Trojan do?

The mobile applications pose a threat to all Android devices by functioning as a Trojan that subscribes unsuspecting users to paid services, charging a premium amounting to around 36 Euros per month.

The campaign has targeted millions of users from over 70 countries by serving selective malicious pages to users based on the geo-location of their IP address with the local language. This social engineering trick is exceptionally successful, considering users might feel more comfortable sharing information to a website in their local language.

Upon infection, the victim is bombarded with alerts on the screen letting them know they had won a prize and needed to claim it immediately. These pop ups reappear no less than five times per hour until the application user successfully accepts the offer. Upon accepting the invitation for the prize, the malware redirects the victim to a geo-specific webpage where they are asked to submit their phone numbers for verification. But in reality, they are submitting their phone number to a premium SMS service that would start charging their phone bill over €30 per month. The victim does not immediately notice the impact of the theft, and the likelihood of it continuing for months before detection is high, with little to no recourse to get one’s money back.

These cybercriminals took great care not to get caught by malware researchers by avoiding hardcoding URLs or reusing the same domains and filtering / serving the malicious payload based on the originating IP address’s geolocation. This method allowed the attackers to target different countries in different ways. This check on the server-side evades dynamic analysis checking for network communication and behaviors.

Overall, GriftHorse Android Trojan takes advantage of small screens, local trust, and misinformation to trick users into downloading and installing these Android Trojans, as well frustration or curiosity when accepting the fake free prize spammed into their notification screens.

How does the GriftHorse Android Trojan work?

The Trojans are developed using the mobile application development framework named Apache Cordova. Cordova allows developers to use standard web technologies – HTML5, CSS3, and JavaScript for cross-platform mobile development. This technology enables developers to deploy updates to apps without requiring the user to update manually.

While this framework should provide the user a better experience and security, the very same technology can be abused to host the malicious code on the server and develop an application that executes this code in real-time. The application displays as a web page that references HTML, CSS, JavaScript, and images.

Upon installation and launch of the application, the encrypted files stored in the “assets/www” folder of the APK is decrypted using “AES/CBC/PKCS5Padding”. After decryption, the file index.html is then loaded using the WebView class.

Figure 1: The application code containing Key, IV, and file types to decrypt dynamically

The core functionality source code lies in the js/index.js file that calls onDeviceReady function which adds “Google Advertising ID (AAID) for Android devices” to appConf. The data structure appConf is populated with AppsFlyerUID collected after initializing AppsFlyer (React Native AppsFlyer plugin) using the devKey. Following necessary checks, the program control is given to GetData().

Figure 4: The contents of index.js file that calls GetData()

The GetData() function handles the communication between the application and the C&C server by encrypting an HTTP POST request with the value of appConf.

Figure 5: The GetData() function that communicates with the C&C server

The request and response network communication with the server can be seen in the following screenshots, where the parameter “d” is the encrypted ciphertext of appConf. 

The received encrypted response is decrypted using AES to collect the second-stage C&C URL and executes a GET request using Cordova’s InAppBrowser. The decrypted contents of the above communication can be seen in the following screenshots.

Figure 9: The decrypted content of the response from the first-stage C&C server

Figure 8: The decrypted content of the POST request to the first-stage C&C server

The configuration for pushing the notifications is received in the response and displayed every one hour for five times as seen in the below screenshot. The motive of this repetitive notification pushing is to grab the user’s attention and navigate to the application.

The second-stage C&C domain is always the same irrespective of the application or the geolocation of the victim, and the GET request to this server navigates the browser to the third-stage URL. An example of the response can be seen below.

The third-stage URL displays the final page asking for the victim’s phone number and subscribes to several paid services and premium subscriptions.

The JavaScript code embedded in the page is responsible for the malicious behavior of the application due to the interaction between the Web and Mobile resources. Some examples of the displayed page and the malicious JS codes are shown below.

There are two variants of the campaign differing by the interaction with the victim:

  • First Variant: Displays a “Continue” or “Click” Button, clicking on which initiates an SMS sending action as shown in the above screenshots. This URI is parsed.
    Example: “sms:1252?body=TREND frcql1sm”.
  • Second Variant: Requests the victim’s phone number to be entered and registered with the server’s backend. Then the malicious behavior is the same as the first variant.

The interaction between the WebPage and the in-app functions is facilitated by the JavaScript Interface, which allows JavaScript code inside a WebView to trigger actions in the native(application) level code. This can include the collection of data about the device, including IMEI, and IMSI among others.

The GriftHorse Threat Actors

The GriftHorse campaign is one of the most widespread campaigns the zLabs threat research team has witnessed in 2021, attributing its success to the rarely seen combination of features:

  • Completely undetected and reported by any other AV vendors;
  • More than 200 Trojan applications were used in the campaign;
  • Sophisticated architecture preventing the investigation of the extent of this campaign; and
  • No-Reuse policy to avoid the blocklisting of strings.

The level of sophistication, use of novel techniques, and determination displayed by the threat actors allowed them to stay undetected for several months.

In addition to a large number of applications, the distribution of the applications was extremely well-planned, spreading their apps across multiple, varied categories, widening the range of potential victims.

The following chart shows the category distribution of the apps found:

The Victims of GriftHorse Trojan

The campaign is exceptionally versatile, targeting mobile users from 70+ countries by changing the application’s language and displaying the content according to the current user’s IP address. Based on the collected intel, GriftHorse has infected over 10 million victim’s devices in the last few months.

The cybercriminal group behind the GriftHorse campaign has built a stable cash flow of illicit funds from these victims, generating millions in recurring revenue each month with the total amount stolen potentially well into the hundreds of millions. Each of the victims is charged over €30 per month, leading to recurring financial loss until they manage to rectify the issue by contacting their SIM operator.

The campaign has been actively under development for several months, starting from November 2020, and the last updated time dates back to April 2021. This means one of their first victims, if they have not shut off the scam, has lost more than €200 at the time of writing. The cumulative loss of the victims adds up to a massive profit for the cybercriminal group.

Figure 21: Heatmap of the over 10 million victims spread across over 70 countries

Zimperium vs. GriftHorse Android Trojan

Zimperium zIPS customers are protected against GriftHorse Trojan with our on-device z9 Mobile Threat Defense machine learning engine.

To ensure your Android users are protected from GriftHorse Trojan, we recommend a quick risk assessment. Any application with GriftHorse will be flagged as a Suspicious App Threat on the device and in the zConsole. Admins can also review which apps are sideloaded onto the device that could be increasing the attack surface and leaving data and users at risk.

Summary of GriftHorse Android Trojan

The threat actors have exerted substantial effort to maximize their presence in the Android ecosystem through a large number of applications, developer accounts, and domains. The Zimperium zLab researchers have noticed the technique of abusing cross-platform development frameworks to stay undetected has been on the rise, making it more difficult for legacy mobile AV providers to detect and protect their customers.

The timeline of the threat group dates back to November 2020, suggesting that their patience and persistence will probably not come to an end with the closing down of this campaign. The threat to Android users will always be present, considering the innovative approaches used by malicious actors to infect the victims.

The numerical stats reveal that more than 10 million Android users fell victim to this campaign globally, suffering financial losses while the threat group grew wealthier and motivated with time. And while the victims struggle to get their money back, the cybercriminals made off with millions of Euros through this technically novel and effective Trojan campaign.

Indicators of Compromise

List of Applications

Package NameApp NameMinMax
com.tra.nslat.orpro.htpHandy Translator Pro500,0001,000,000
com.heartratteandpulsetrackerHeart Rate and Pulse Tracker100,000500,000
com.geospot.location.gltGeospot: GPS Location Tracker100,000500,000
com.icare.fin.lociCare – Find Location100,000500,000
my.chat.translatorMy Chat Translator100,000500,000
com.bus.metrolis.sBus – Metrolis 2021100,000500,000
com.free.translator.photo.amFree Translator Photo100,000500,000
com.locker.tul.ltLocker Tool100,000500,000
com.fin.gerp.rint.fcFingerprint Changer100,000500,000
com.coll.rec.ord.erCall Recoder Pro100,000500,000
instant.speech.translationInstant Speech Translation100,000500,000
racers.car.driverRacers Car Driver100,000500,000
slime.simu.latorSlime Simulator100,000500,000
keyboard.the.mesKeyboard Themes100,000500,000
whats.me.stickerWhat’s Me Sticker100,000500,000
amazing.video.editorAmazing Video Editor100,000500,000
sa.fe.lockSafe Lock100,000500,000
heart.rhy.thmHeart Rhythm100,000500,000
com.sma.spot.loca.torSmart Spot Locator100,000500,000
cut.cut.proCutCut Pro100,000500,000
com.offroaders.surviveOFFRoaders – Survive100,000500,000
com.phon.fin.by.cl.apPhone Finder by Clapping100,000500,000
com.drive.bus.bdsBus Driving Simulator100,000500,000
com.finger.print.defFingerprint Defender100,000500,000
com.lifeel.scanandtestLifeel – scan and test100,000500,000
com.la.so.uncher.ioLauncher iOS 15100,000500,000
com.gunt.ycoon.dleIdle Gun Tycoo\u202an\u202c50,000100,000
com.scan.asdnScanner App Scan Docs & Notes50,000100,000
com.chat.trans.almChat Translator All Messengers50,000100,000
com.hunt.contact.roHunt Contact50,000100,000
com.lco.nylcoIcony50,000100,000
horoscope.fortune.comHoroscope : Fortune50,000100,000
fit.ness.pointFitness Point50,000100,000
com.qub.laQibla AR Pro50,000100,000
com.heartrateandmealtrackerHeart Rate and Meal Tracker50,000100,000
com.mneasytrn.slatorMine Easy Translator50,000100,000
com.phone.control.blockspamxPhoneControl Block Spam Calls50,000100,000
com.paral.lax.paper.threParallax paper 3D50,000100,000
com.photo.translator.sptSnapLens – Photo Translator50,000100,000
com.qibl.apas.dirQibla Pass Direction50,000100,000
com.caollerrrexCaller-x50,000100,000
com.cl.apClap50,000100,000
com.eff.phot.oproPhoto Effect Pro10,00050,000
com.icon.nec.ted.trac.keriConnected Tracker10,00050,000
com.smal.lcallrecorderSmart Call Recorder10,00050,000
com.hor.oscope.palDaily Horoscope & Life Palmestry10,00050,000
com.qiblacompasslocatoriqezQibla Compass (Kaaba Locator)10,00050,000
com.proo.kie.phot.edtrProokie-Cartoon Photo Editor10,00050,000
com.qibla.ultimate.quQibla Ultimate10,00050,000
com.truck.roud.offroad.zTruck – RoudDrive Offroad10,00050,000
com.gpsphonuetrackerfamilylocatorGPS Phone Tracker – Family Locator10,00050,000
com.call.recorder.criCall Recorder iCall10,00050,000
com.pikcho.editorPikCho Editor app10,00050,000
com.streetprocarsracingssStreet Cars: pro Racing10,00050,000
com.cinema.hallCinema Hall: Free HD Movies10,00050,000
com.ivlewepapallr.bkragonucdLive Wallpaper & Background10,00050,000
com.in1.tel.ligent.trans.lt.proIntelligent Translator Pro10,00050,000
com.aceana.lyzzerFace Analyzer10,00050,000
com.tueclert.ruercder*TrueCaller & TrueRecoder10,00050,000
 *This fake app is not to be confused by the legitimate Truecaller, by True Software Scandinavia AB  
com.trans.lator.txt.voice.phtiTranslator_ Text & Voice & Photo10,00050,000
com.puls.rat.monikPulse App – Heart Rate Monitor10,00050,000
com.vidphoremangerVideo & Photo Recovery Manager 210,00050,000
online.expresscredit.comБыстрые кредиты 24\710,00050,000
fit.ness.trainerFitness Trainer10,00050,000
com.clip.buddyClipBuddy10,00050,000
vec.tor.artVector arts10,00050,000
ludo.speak.v2Ludo Speak v2.010,00050,000
battery.live.wallpaperhdBattery Live Wallpaper 4K10,00050,000
com.heartrateproxhealthmonitorHeart Rate Pro Health Monitor10,00050,000
com.locatorqiafindlocationLocatoria – Find Location10,00050000
com.gtconacerGetContacter10,00050000
ph.oto.labPhoto Lab10,00050,000
com.phonebosterAR Phone Booster – Battery Saver10,00050,000
com.translator.arabic.enEnglish Arabic Translator direct10,00050,000
com.vpn.fast.proxy.fepVPN Zone – Fast & Easy Proxy10,00050,000
com.projector.mobile.phone100% Projector for Mobile Phone10,00050,000
com.forza.mobile.ult.edForza H Mobile 4 Ultimate Edition10,00050,000
com.sticky.slime.sim.asmr.nwsAmazing Sticky Slime Simulator ASMR\u200f10,00050,000
com.clap.t.findz.m.phoneClap To Find My Phone10,00050,000
com.mirror.scree.n.cast.tvvScreen Mirroring TV Cast10,00050,000
com.frcallworwidFree Calls WorldWide10,00050,000
locator.plus.myMy Locator Plus10,00050,000
com.isalamqciqciSalam Qibla Compass5,00010,000
com.lang.tra.nslate.ltefLanguage Translator-Easy&Fast5,00010,000
com.wifi.unlock.pas.pro.xWiFi Unlock Password Pro X5,00010,000
com.chat.live.stream.pvcPony Video Chat-Live Stream5,00010,000
com.zodiac.handZodiac : Hand5,00010,000
com.lud.gam.eclLudo Game Classic5,00010,000
com.locx.findx.locxLoca – Find Location5,00010,000
com.easy.tv.show.etsEasy TV Show5,00010,000
com.qiblaquranQibla correct Quran Coran Koran5,00010,000
com.dat.ing.app.sw.mtDating App – Sweet Meet5,00010,000
com.circ.leloca.fi.nderR Circle – Location Finder5,00010,000
com.taggsskconattcTagsContact5,00010,000
com.ela.salaty.musl.qiblaEla-Salaty: Muslim Prayer Times & Qibla Direction1,0005,000
com.qiblacompassrtviQibla Compass1,0005,000
com.soul.scanner.check.yhSoul Scanner – Check Your1,0005,000
com.chat.video.live.ciaoCIAO – Live Video Chat1,0005,000
com.plant.camera.identifier.pciPlant Camera Identifier1,0005,000
com.call.colop.chan.ccColor Call Changer1,0005,000
com.squishy.pop.itSquishy and Pop it1,0005,000
com.keyboard.virt.projector.appKeyboard: Virtual Projector App1,0005,000
com.scanr.gdp.docScanner Pro App: PDF Document1,0005,000
com.qrrea.derproQR Reader Pro1,0005,000
com.f.x.key.bo.ardFX Keyboard1,0005,000
photoeditor.frame.comYou Frame1,0005,000
call.record.provCall Record Pro1,0005,000
com.isl.srick.ersFree Islamic Stickers 20211,0005,000
com.qr.code.reader.scanQR Code Reader – Barcode Scanner1,0005,000
com.scan.n.rayBag X-Ray 100% Scanner1,0005,000
com.phone.caller.scrennPhone Caller Screen 20211,0005,000
com.trnsteito.nneappTranslate It – Online App1,0005,000
com.mobthinfindMobile Things Finder1,0005,000
com.piriufffcaerProof-Caller1,0005,000
com.hones.earcy.laofPhone Search by Clap1,0005,000
com.secontranslaproSecond Translate PRO1,0005,000
cal.ler.idsCallerID1,0005,000
com.camera.d.plan3D Camera To Plan5001,000
com.qib.find.qib.diQibla Finder – Qibla Direction5001,000
com.stick.maker.wapsStickers Maker for WhatsApp5001,000
com.qbbl.ldironwachQibla direction watch (compass)5001,000
com.bo.ea.lesss.pianoPiano Bot Easy Lessons5001000
com.seond.honen.umberCallHelp: Second Phone Number5001000
com.faspulhearratmonFastPulse – Heart Rate Monitor5001000
com.alleid.pam.lofhysCaller ID & Spam Blocker5001000
com.free.coupon2021Free Coupons 2021100500
com.kfc.saudi.delivery.couponsKFC Saudi – Get free delivery and 50% off coupons100500
com.skycoach.ggSkycoach100500
com.live.chat.meet.hooHOO Live – Meet and Chat100500
easy.bass.boosterEasy Bass Booster1050
com.coupongiftsnstashopCoupons & Gifts: InstaShop1050
com.finnccontatFindContact1050
com.aunch.erios.drogLauncher iOS for Android1050
com.blo.cced.als.pam.rzdCall Blocker-Spam Call Blocker1050
com.blo.cced.als.pam.rzdCall Blocker-Spam Call Blocker1050
com.ivemobiberckerLive Mobile Number Tracker1050
 Total4,287,47017,345,450

SHA-256 Hashes

  • ff416417d3dd92f8451cdd9dcce5ef78922e7e2c8f4d35113fbc549eac207d4f
  • f0d855e9c861df0e259017b7db005cadceb5046e9325551d05490681d35799a9
  • ce0ce6380207ebb5d9bb735a193be8cdec9ae60140c6dfa261f6632d18a89bf7
  • b7501b603c603d314b3653cfed74c92db88d16095150fd4e446bd1c5dd46a10a
  • 91384eaebda21e297bf9fdb0d33e8e41e8e9548a3440c73e34b8c16c3b3904f6
  • 929fecf19a3e7732123d6619e179717148d570ea6ea2f6505ad2e3da373699f8
  • 6e43d1ffb0625546b8847e893c117ca28100cd1f443beba496162ef3cded8354
  • 4ea94dcb7efc2697b169b4d4c683bc0c400e7df200a5e2596652d0bfe9b85f25
  • 4ab829e04540b1f93a39f82ca340383e3ecdc32d7f3ab2195f147a4880bea868
  • 46ad9196a639c30ec7a1abcc606c636a1dffacce4f66c1bca72fd75fa85388e4
  • 45370018a532c898260ee8f002e999f02b04d87e9616be2fc067fe10890d43dd
  • 3d9c588cebae8b8e3623b21b875ee01d8d6bd8c5e56da84b08c2742a8448c5fc
  • 35d05e908ac10eb46d5ab98a98928dac8b2878d9f2f3e175383b1c81b6ddf914
  • 1651935da48b2c1dc99a92a10867b43f5d043351bcbf3147d2d399642d62f9b6
  • fb22a23bf22cd92dc943bec6447750b1579410274037897d3b5bb88b1284850c
  • d1e108c8b6271a17380f7c8fbbb5fb708e141805f6896a013f82adfa722d1039
  • 0f3a60b69118e3df202519d6055ed6770247eefecee0ce9f90d7bfbd5e6753b3
  • 44d1c98b1c5e9bab26cbce81e2410ffe7e34c1bd7743e5bdcc39aabc42c0d555
  • cf592e98adcdaf420dc7d3a9c9a3761361ce25da9fc753764fd6fc97a075e2e6
  • ab96a84570864d93197b4fee6bfabbda71f03a14e9f68ad43dcd91ea7e8580d7
  • 8ce77122538b8229763f16ecde830b4c1ad0a2eca45cfbbe201c6d74e0e0e22d
  • 96476dde2a88bccc7c18cc03330a40c96be83cfeab579ab22a2b16920490093c
  • a7d9bb0abaed3c64de19397bc43634c7de66fde2e93f7a7efb7e7436b8ac5281
  • 8f3f1d76e936ee0fa7ff376047ffc93af52e0525146613cada73073b0f5912cd
  • 14f0f17d141c2046a08791832f77bf5094351d5b423aeaaaa2c60c69d376066b
  • 1ed3432b12674ae08b7498cb2f4563a943be0465b43eea8ff43598c40606986d
  • 69436017be7a84ffe6d33f0af5d1f30b808d33963e86cbdb2a1a4d5f547c914f
  • 4b3fa41cc5fb57d81b3cf45e12b6d1919eca94aca71c5802bd5fac129d6e3b6e
  • e7032d405ae2c0ad0e5305aa622221972ea823b3103d1cd716bed23c6c5f0dd4
  • ebd44c1e2f5ada0856b697e55b2cc3b97b06989fd3f1a1027c1529d8886d9407
  • 9aa47fb545f47b2f7fd04e6e3f8538dc3ba080600ccaf5ac365f6c654f04fda1
  • da18353654d5bd203121e45c9b646f8627c9cd13bdd0b89efbd6bd474c43a071
  • bb379d290d4302d7c99c346ec2977eafded408fcfbbd94efc0d6cd6a97e8fb9d
  • 21e38ed61c47b4bc111628abb062935d7ceb098b3e4d9b0700cbfd2eb6df14ee
  • 3eab6afb8ead7bf397d8c7197b4bced70d25412cedc4b3a54c8429ad55fff8a0
  • 7eaa1f41da36ff981ee7e2e6fd3a5cff0b5637643dc06d2175cf39eec6fe9dda
  • 474f7a8c16e05c232c14e884e3ac0fc398b9846a31374b797973b67b00e1cba9
  • 5614c7be63665b035ba6cc4b9c63f931438087d74781a988e905f4b6352f02d6
  • ee2465ab469a37df006c5a3762ba47314fe80fa440cee17780d01dc081a14d54
  • b55f869ad0d5716cd56f74c0562cdaa105558bd5dcf91ed7c277b527e7cfa62c
  • 03332e8c57a4ac52ed0022511a9a1a30e7d882ff61fe9a58c7ff7335e060d5cf
  • 8ab58860af76c868b649fe47a8bb62ca369da7996c05763c45270a88a156b402
  • 2acace4074b9841c2d425c190a26046c2c1524b30d68d49bf3e3461ebbd1d14d
  • 5929b3ab6f2704d39d830b11b29b7cdbcbc8f7f8c4d7151fe5e925ed9170d6d4
  • 6ff10891cb70735e647ea87cfe709ca07300f9a5bd7169a0873225467376b590
  • 1d7e191f53f79f3b689a12f7ede899f86f6c8d558ad30bd6f03e3deb50005509
  • 6adb58b56f55d33b1a119f8bf0ba7dda5cb278d5baafab82152ca973800f0fea
  • f2fcdfc33bb8d64f27f977d3bb1d3dc0f5b7116ae48f863bb6fc661cf52245eb
  • eed2690fee3fd58402ed6761820771cf7a533388dac540416eab133f8654b30e
  • 1d1cfd8a2ebe1ab9de814f940ad46c45e41663071d9c410a4253edf707de4019
  • 08ec72048236a428bf7689b4f75cb4b712025b8fa0e1d17fa95638666e8d4834
  • 77d3b72999a6116e479ff080285aea88d8a5b4d1d8d9b76049940e48de3bf5d5
  • 6db319ce8b9d302c6636e04d2dfebf0e06191cdd3d35e1c31c0b01407dd8c8fd
  • 0ca050d64480300f423017ec6e4c9c66c9eb7582f610f9cd05c3853da92eb095
  • 5a0964dd0747d199bf1db9d412351e72c6f3dde9e2026b6108eabb4b0ce0cf5e
  • 9cae4295c29048834bf98d516ea7a1d97b283eeff84b22bb2c25f9e96ad8284c
  • 6ddd1bff3205cb7c0843ed6d9b560728ede04ce32ca5904c1626a7da9873262b
  • e834465baa9eb897541b95fe0099d3aec071fe185e99376e23f61a9ee7e48bfe
  • 182367b782dd32f64e36efdfaa5e9dcdf4fc7247431ba012179f22a20cc60866
  • 6c4a226c78027fa5b157a4be3a5aca84038bf9477ede98b7e358b826b60c1fc7
  • a8fdd46918b5a04a56e858d95bb9a889c427d29496892204a226d25e3e47d538
  • 3b8190a4b7ba8e8c1793297cd2710f32b1768de8207231405c0cf081b1071f9d
  • 8ae234729626e616a44bb9a64b24c1b792a58cebf502671fd1a8313c3ad5c440
  • 7c2cce644a17faf30a7a1748e162bcb45e89e4be5d45807f538e146d3f161aa2
  • 0e38628fe2b91659314ec6e00e4fbdcc7f76f1e45921456eda78cab87b8cd718
  • 98b77f6aa77a6853e0faa6652c9a705fdd22d9cd0518cf5eca03d3c107f94868
  • 51b489b6a89c1d758efa02279859bbe67c112342b9ae98ac9bc04b2f7dc0d2ec
  • 37b535cb5db504335f76aaccd84e0ee877f1143ed9b1389c058928a52a6fa16c
  • 3c1fbb9fef73aaefacad4071041a200be6604c72445f040baae875ff8f00eb6f
  • f7621c9e5bf55f92362e3b5979caa82dcb3313921c7ed73d3686f5f888673f2a
  • 64aeb474694d98a892f08307e98878453985b9564a5bc303607e56b6fcc15044
  • f26fcedd4b8c192cfbd88d1d10ed5fc0e16a9e4d65be64b2647c564626fd0aaf
  • efb490c02d3cc342a29ce25540d5c051f38e0d1859bb06ff33e8b0145da66a6b
  • dec06930b8142612254832169572056b3e79321ea6a367cbf8e0602bc8f31afb
  • d5bf3f22c07a39d77098f719c8a145c7cf473404c2324ca6c76c1e87f050605c
  • ca1b3d4ec274b3528ffad5ecb0d3dd6871ca9a64c0ac35bf7528db36b2e5ebf8
  • c9905ab199440a9dec557c5970462d2f146c1146f723914cada099549e4819ea
  • b6f9c4bdbbe157245b069a54f1d9337f03f71f1e893309f10e6bdcfd2c7c0311
  • a9179292500189c95e91743593e06ec5737958b09ffecbf76fbd65724090ecda
  • 7a050f2c2c43b6c5443092c79f9431e50f610824043be5489a3e95084fad6e4e
  • 756b247e59d8ccdaa13f01cf9d9c7587488ce2af912aadd31339e43642ead3e4
  • 6937abe088ed1f8d98664025f5ecf556a3e04c73395f80742cd1505eff1f84ed
  • 582df77b3cebb7e6be00335a3116e266cc48426f2657bc13e6b8e6ff96a7b209
  • 4f4e7c77ab8a9665abbb47a211e7836a590d09ec5151634acdedcbe56076943c
  • 4e43d2a3a8274b9be8e1b7d499dd4b902ddf22bb838ed2040133419026d09bfa
  • 37e84f4fc9efec79ca30c8ef55c0c6a1ea29ab23c54d8e68ec16787346841c01
  • 2f28d1a5b84c0262aec6c631e58b1015b40dea878e33214bdacc5568e3a3ec82
  • 2a79dc27e1c2126a1d985f49eb742ed73bd5ed0c0d78bb79c9da867e60c15ba0
  • 273eb89b2ca8bb6f3a1b73a1660a0b67dc9875db43fae4599ce593bb22e3de75
  • 2177fe1fbfbd8ddca47cde0620d974f5b31c0a4ff206968732d2b62f67367a1f
  • b85f688e517aa59863347d277f5b05c43b40050a93c16595f275edd2fe15ff16
  • 7407ca45c85619d0dc6a2ce7c7440bb8717e90ed7e0661ef254190dc6f7bcfe0
  • a794623cffa950294d21e29eeb03c31b2ffe507a0edb0bfa7fc16491e89bd462
  • 4d915f18eea64ef2ce199c8dc34ec3e165c34faf6f692532ee50c33872f711d5
  • d80d7312c969d7f5882270b4000363897bdfb3fd58de91a834bd97022687d865
  • 928c5b7d61ea3e6cd8b7a3b66cc72aa2a79c6f8d45ea8881511bd9a6bf89db87
  • 5602e7bded2bc79e9c7edf451e928c88b62a9e3bf8bc66772e237d891e67829f
  • 8a296b5049375d730aca83da783469b1e7454825851c8c1447614ec1d0563376
  • cbe433c84f6e37fa63a41c9621a1260fa16fface96d5c98e4346a670e0e0325a
  • bfce3f0e66ad8b6f62123ae7474afb3e387e24501f1ae78dd44483ed4a7d8a53
  • 5ffcc446b030c2153c4f418843944372707f0da1bf34cb3c92fb32c6b4005a49
  • 00ee123526f8fe7b4a8b05e88c0713ce1bc2fa9cbeb9f5bbee4f2eee3cda9a9b
  • 04be1599fa13fc48d55b0220eebb074e4dcaeac116e3e0f4972bf6d6e841f041
  • 2f9322eca349ab5de1032f006c62e35bc96e944ffd852f65c6f2cdc11c0228f9
  • 9ecf6fd57ee4a48cda0a11f32d7bb8ed9b4908a3199dc37c5fb9dc58e1ad987a
  • 68e51b98abf75a67b90c4381b51c381dc76f927372bda3508e91c5c149c90cad
  • 1144df26b81e8d24b62d78ea8dd57d5e418a7763564388a4c5fe1abbb503247d
  • fd315330865630acf61602a13398f4e3d02170623a4fd384aa683bd603788f36
  • 5a4cf63e880427788380852f7d904f4850caeda513c79fcf60eed8f131ee2de9
  • 501fce060fdcddfb280b78a60102c357ee7179c304a7c9d5b953ffe824eca9b3
  • cea5b0b98be986ab77d15b240e199196bccf0f2cd34d3d8df9c6885fae138cd1
  • 6d2fad75b944b10e0ed5c741fc77c644d9a45625ff71043b1c2d570744a3e6a2
  • 27166a4ea88ee845d723102bea922d31dff95caf243b67fe12ed9005d68ea2c9
  • 5fc9711772d66f9ebc087b7df4bf59212264ad52bf3f9735c4ae7b32667588eb
  • 98923041af8da702ea0bc08063ac969230eb37c3ddb167995de65b2fcad02991
  • 35efcff05df6cfeeb3d4b42e347b94e9aeb69a0a6bf92241ee1c91f7539a075f
  • 0b3ae8423911939db258a084e57c32bf01ec31591d70e2b5bdac1a909033254b
  • bc77f5335b78b141c494bfedc6943eda10c988e3f0a2c3f2d324843a1ee7ccab
  • 8916ffdd94b4083632e7badcb3eaa395c75c0040f90fd5646419f6eb85f99e78
  • a71a195594a73dd3f2515c2c6af0a460c1408013863b786a83344ba3dc4d48e7
  • c0471564c593846f7946d131ebf19977e6d7178314f770e29b9526b64acba5a2
  • 2998f4812bd7065feed3dc2c8df5371f03314b8225bf3e7ff7a2de6af22f5cc6
  • c0e8adb56316648f00dbcfb2cd6eb0ca86e452d5e42f4f22eea7f1b4566c39dd
  • c51543f120edd5e139cf6e0724f0c53e02ad239e00cbdc44aaa7014aa428a9ea
  • 5c820cd0e061ab8bf511266ea698953ef18570d04f79bcf5b7cdfda76bbf60cd
  • 9f2ee572f3c9480902ae89388024cd899c21c60d8ba831a18c48664cb0120141
  • facf85fda6fb18a242426841ee7e7040f2cae8110366537437d30b5e7296d5f6
  • c69a0286d66b745a291d6c2c082de79312ff56244017005ba5062f9471a0c018
  • 4180c27688b43c39b06c9edb6abadbcdd6ddea13c2d69c735fe9a2b2963bbff4
  • 4a438466c6630fd47c4464c87fc8c77ba1cd9c6e6e1b2c52999f95932b4b1e82
  • 07ec114d227c189e7cde6dde23f93f5f6789f4d00efaccab390ba983e34fc545
  • 710e27c1569a57f44606f0210fa57a0ef5c1017c2142f0e5f013bc956df98a6b
  • f0b9f50a3f6cb9d32c3beac54dd8c360656985d5ea255c93f5a71bfdbf5a1480
  • 9cb697e81f1b860de48f0068a6dcb32e072c2fe50c621e943752cfe45854378a
  • b3f630c15eca6b75ad54569505ddcea9a610dace2779f81b29652bb5f0a02455
  • 1bbb28d6c13c7ecf99fac714de472ae7d3dbd62babd8f03c2fc2dff763427401
  • 5107a89c49ca298d817de81d2565d9df1581c48d5b3a158d0ee8c24c2c0c5d9f
  • a359bfedd6d2937caaf177d6a348201f20fbe048828615ae2cf7de6d3cc0160e
  • f7f329d104cc12e650fd772002f8e0a0a37e0567667cf1b0d39cb576e67d56cd
  • 507c720f4dd6bfcb6d2438cefc3dc445866fe607b405333e3d5da0e644f5d818
  • 1f2e5cfc7852c2ea5d99d2eda24be749f83ad0aa7a21d594eeb4ec864be93ea6
  • 40afbf5f8a2ebce34e5fb4f2e9b7ffa43d0242399e98d4f667e14874510b877a
  • 925a63cbd222acf1b03b3813bf18e32adb42904626f69c5e9fe8ccd922607dbf
  • 9d76b80ac1188a91215d9e9097dd78d181f801eab0055129b91984c43260fd22
  • 3161fb498ab96fee38dd6fa6f86d4dd64a320e48114bf29c3209e0829fd497fe
  • 36af36a7f4582b3c2cbf4444b7d7875e8bed53a7d604833eb6d0fc89227076d9
  • 85e2c04bbafcdfe2472a27cd36210b72e4a0c12562083284b5d3e163297dacb5
  • eb168c59737be43db0f15af0882498c2124d9d22a42805e7a0a6abe01b0ab70b
  • f3b7699b3e7f42b8e5a6905057b3799f2e0fa00ab8bd62321739b1e5d9c79f24
  • 189db11c58336b9a8d9c09a03c3323b3948026064ed9f36af1e14671a8ae7379
  • 036dd89e723a6d73b21d4f3444e07494e7dce4ca4ad7286eb8cf9471b96c2397
  • 279a9f9b8a2ca3305a4a58873726c6923bf191a027649c70ba39d42e3f2b20c8
  • 9395760c4010f1d4947866a3ec8745be5f322bd35e3e837bde2f7c762d2cb7cc
  • 5cba0c49750ee898bfe480b457ddf44e5d46804b7ad54f341c9858f46530e05c
  • cb1654e73e6776de91fe50acd2c7dd0c056116d69b52718208f7cbf5290ea4cf
  • e3f55b306195d1213ff3177f12ce733c320414a60c488211e5d18a32218a03f0
  • 05b94f86add51876184dddc365c9f3aec357e9806121dab77c46734d0372bd87
  • e766bfbf0c6cab2839881b2ff907b98c1fb5e13d1f8ddbfcc4d63404f2d62c50
  • fe8c3620a0be66e215bf895e3d7251cc01d9c906567b621fa113abbacbcd7163
  • a4672c803139e4485231b27f7aa33763f90d3453d4cabcc359b2b6b4b76d3656
  • df18f1e6fa6e1e74382d264634851318ec8fde8b78cc59c2e4b176f15d7f8ba2
  • 7cd06bd94867345416a07b8621eb8e88cd155edc5cba575754878d1117bc4a9a
  • 9203ccae1ccc1da36cd1ef893585d471bdd5401834c278397210313312ff846a
  • 60c1d4abfa9cdec0cdc02f0eceef5fa8b90c66fd87c68bdac567a656a7dcec5c
  • 7239f1747a12e7b3d03bee392e00ef8737a5d0793c2649d5b0a55fedf9415f00
  • 29334161d1063e16a7e3ae8bcd559bb386b31877f7f9610b3605407951450e10
  • fa3d97e934ffccb711008fb37216c049b84add0777975d63c577a1e12ab7f28e
  • 4a5aa5bc5df167c9ebe2445113518bb96afb03f93f6b3e00c8068ebed9e90233
  • 2da794aafd7352f57b63075031fac2a8cf7a07bb93b056ecd2097cff67dffdf9
  • da9c447ee1596d575fe05cec44121977841ff7a7a3dcaaeadbc7f668021139ce
  • 7d43c17680d306cc6c33d19940f47c08d019a20659a9bac2d309131a7bacf413
  • 5e8ce7071791e022bd917105c0c5e0f4c46fcda7ea5b75facc4c1590b2603717
  • 9bb0df13442c8917554dfc745fdb23161b921a3ead5b226d5708ea93b0e22427
  • 5ed905de288bdd107415d0418170c7edfce7945db24ce706936c106c8e0a4ad1
  • 7237e69c205607a1c088c56d6ce13806e78880872b2786d5c21a383fc9460593
  • 749cdca9c3342c88e486af2c18ba6271081ef724a49448393c563c8cf1f9f180
  • 9a2ff84123eff6601b23fd43d037e8e3b944f9370742d7db61d1ab395b2449a2
  • 4cf3847cd10002a05725b3356efc2c56f34d435c1c15e5bc349de2c6385a3d77
  • c1a88cf565c297709bb851f18997fddee9375956b1eebef675c502f62f2c12b2
  • 670432f67029b758cbf5e1e99cf33ab07f4c3fa95063943141ae0562a8ca7bd0
  • aef185ee521adb0427412fe8ea05ff5f87f6a771ae2d89410bdc95ed11d31940
  • 4991f9b38c55bd386f8b842e715b729b8be3a39b5b4876655ffd33505abb08ea
  • 92474c894b305ecd98f60e9e31dfc0c7e795d12d75297a6aae8cd8fe37e25fa6
  • 9c22915c3777db5aed6e4a7589b223049fd17a902df8a669d5af7767a862f00d
  • d96c32412bfd342a22a66063f082d7f5db7279c2a443cf00d476b5e119cab2a0
  • 2ef4f47ee98aaf3a42e475ed79846360c213a1a8cd048813a617caacc5ad162c
  • f60d6d0982117641548ee885d6ca776efa53d4c6bf5bbe67b55572122f00539c
  • cb2027fd1ee7adc8f33442fc96a4fb6f9544e9f43ae686adc5a3ae42bf1ffa2d
  • 30fcdaf69412a3168d626971f580fef5167b8126c552b253ac9eac8a0f52302d
  • 8d38f4452886e8a5b61a69e3c152b86e41dc58a98bde30bf2c6e534c3df8b7e3
  • da16ca2c38e932fdb134155fef60971378fdb1fb0d86808e4747b97b3e77b305
  • df140126dd446c85a3a96682e5c5f9d24601ffaa926e974ea2fe09e24a7fbc2b
  • 7390c69901e78948d37acdaedb03fbbbcc9406ab5f463d5cf517b139d469aa11
  • e8c7473053088c4272ed5759483e140a5806c908ee431bb4dc766c93bec35d64
  • 5fe1994d82029e19b4b762dd6411bcb03a768954773b722b9509147b979ef9b3
  • 59e3509792170808b648a2e1bb7e465808ddb6607bc3f60c0233175feebdf13a
  • db9936e6de8105310098f4ff329bdd29710fe381a868a5aa66274ab31be69a90
  • e614b658e651ec8c0d0b755ee27beb4d0e22eb0c20135b9f3af9769166fad053
  • 7e170d3ad5ed123cd4750d333ca6534fece35b7239460318accd26bed6ffea6d
  • 6be1181ba297bba9a32421c5728ebcff7f7ce9812c3be52aa29e38feb1e9e17d
  • db9936e6de8105310098f4ff329bdd29710fe381a868a5aa66274ab31be69a90
  • bf36816c330bc4e67e5cb9f34d8476501e17b3e01ddff77d0e45a3d29654be00
  • 32c2e9f647dd9a875fffc48d6c219d7609683217aa18d07963e7a0419054a513
  • be9f804a36e53c570e73292dc103a43dd062231927939701748ced00e25a2403
  • be4a2e1f91f092d0cebf34cec0493f5aee44ce3329be036b741b0f72a5f841df
  • 7b8822836ed375bae651f4bb44d020ac000de6503f403fa9d7d039058456169f

First-Stage Domains

  • hxxps://hotofecro.com/
  • hxxps://alaiblompass.com/
  • hxxps://heartratteandpulsetracker.com/
  • hxxps://icoonectedtrack.com
  • hxxps://ospocatracker.com
  • hxxps://laalaslirayeblection.com
  • hxxps://iblompass.com/
  • hxxps://smalllcalllrecorder.com
  • hxxps://anguaganslatast.com/
  • hxxps://oroscopemestry.com/
  • hxxps://blompascator.com/
  • hxxps://leunoon.com/
  • hxxps://arindocation.com/
  • hxxps://rooitor.com/
  • hxxps://mychattranslator.club/
  • hxxps://rulapptoplan.com/
  • hxxps://rportranslator.com/
  • hxxps://muslimasauda.com/
  • hxxps://martpolocator.com/
  • hxxps://wfupppx.com/
  • hxxps://scandocnotes.com/
  • hxxps://freecoupon21.com/
  • hxxps://ponyvideochat.com/
  • hxxps://ludamec.com/
  • hxxps://chat-transa.com/
  • hxxps://soulscanneryh.com/
  • hxxps://d3cameraplan.com/
  • hxxps://qibla-ultima.com/
  • hxxps://zoofanimalm.com/
  • hxxps://ciaolvc.com/
  • hxxps://heartrateproxhealthmonitor.com/
  • hxxps://bus-metrolis.com/
  • hxxps://truck-rouddrive.com/
  • hxxps://locatinfind.com/
  • hxxps://camerdentifier.com/
  • hxxps://locatorqiafindlocation.com/
  • hxxps://cocachar.com/
  • hxxps://squishyp.com/
  • hxxps://antranslaro.com/
  • hxxps://ftphotom.com/
  • hxxps://lockul.com/
  • hxxps://fingerprihanger.com/
  • hxxps://locatorshar.com/
  • hxxps://kfcwsa.com/
  • hxxps://gpsphonuetrackerfamilylocator.com/
  • hxxps://cailrecorder.com/
  • hxxps://tqiblacompas.com/
  • hxxps://kvprojectop.com/
  • hxxps://pikchoeditor.com/
  • hxxps://streetprocarsracingss.com/
  • hxxps://nemaeovies.com/
  • hxxps://aecodero.com/
  • hxxps://ivlewepapallrbkragonucd.com/
  • hxxps://heartrateandmealtracker.com/
  • hxxps://phonecontrolblockspamcalls.com/
  • hxxps://etcotater.com/
  • hxxps://canopoument.com/
  • hxxps://locxfindxlocx.com/
  • hxxps://mnesytrlatr.com/
  • hxxps://huntcontactz.com/
  • hxxps://intelgenttran.com/
  • hxxps://facenalyer.com/
  • hxxps://fnbdeiegpslocoiatntcrkaer.com/
  • hxxps://trcalluecodr.com/
  • hxxps://qrreaderpro.com/
  • hxxps://itranstxtvoicepht.com/
  • hxxps://qiberiblaon.com/
  • hxxps://iconylc.com/
  • hxxps://lsepeanitor.com/
  • hxxps://fxkwboard.com/
  • hxxps://dehcoveanager.com/
  • hxxps://tickeakhatsp.com/
  • hxxps://phoneboster.com
  • hxxps://phonfinbyclap.com/
  • hxxps://aralaper.com/
  • hxxps://qibdirctiowa.com/
  • hxxps://islsrickers.com/
  • hxxps://feartranslator.com/
  • hxxps://vpnzfep.com/
  • hxxps://snaplens-pt.com/
  • hxxps://qiblassirection.com/
  • hxxps://easyvshow.com/
  • hxxps://qibla-quran.com/
  • hxxps://qrcodesscan.com/
  • hxxps://hoolives.com/
  • hxxps://burivingsim.com/
  • hxxps://coupongiftsnstashop.com/
  • hxxps://fingdefend.com/
  • hxxps://projectormp.com/
  • hxxps://forzahmobile.com/
  • hxxps://artateulseonitor.com/
  • hxxps://sslasmr.com/
  • hxxps://bagscaner.com/
  • hxxps://phonecallerscreen.com/
  • hxxps://datingappswmt.com/
  • hxxps://lifeel-scan.com/
  • hxxps://colorizerset.club/
  • hxxps://expresscreditcash.com/
  • hxxps://ccallerx.com/
  • hxxps://transatitonneap.com/
  • hxxps://lasouncherio.com/
  • hxxps://claptfindzmphone.com/
  • hxxps://mirrorscreencasttvv.com/
  • hxxps://ircleocatinder.com/
  • hxxps://mobleingsder.com/
  • hxxps://proocallerr.com/
  • hxxps://frecalwolwid.com/
  • hxxps://allelpcoonmber.com/
  • hxxps://faspulhearratmoni.com/
  • hxxps://fincconttact.com/
  • hxxps://uncherdroid.com/
  • hxxps://iveilembercker.com/
  • hxxps://lepamcker.com/
  • hxxps://lockaaocker.com/
  • hxxps://onarchbylap.com/
  • hxxps://secontranslatpr.com/
  • hxxps://tgscontakcs.com/
  • hxxps://lockaaocker.com/
  • hxxps://callwhozdine.com/
  • hxxps://perargero.com/
  • hxxps://mylocatorplus.club/
  • hxxps://comclap.club/
  • hxxps://callerids.club/
  • hxxps://instantspeechtranslation.club/
  • hxxps://photoeditorbest.club/
  • hxxps://piction.club/
  • hxxps://driveriders.club/
  • hxxps://skycoachgg.club/
  • hxxps://ffitnesstrainer.club/
  • hxxps://racerscardriver.club/
  • hxxps://fitnessdias.club/
  • hxxps://meetingonlinechat.club/
  • hxxps://fitnessgymup.club/
  • hxxps://editsbackground.club/
  • hxxps://cutcutpro.club/
  • hxxps://drivingexpiriencesimulator.club/
  • hxxps://clipbuddy.club/
  • hxxps://horoscopefortune.club/
  • hxxps://ludospeakeasy.club/
  • hxxps://fitnesspoint.club/
  • hxxps://wallvoluminousfourk.club/
  • hxxps://cvectorart.club/
  • hxxps://ludospeakv2.club/
  • hxxps://callrecordpro.club/
  • hxxps://carracer.club/
  • hxxps://slimesimulator.club/
  • hxxps://offroaderssurvive.club/
  • hxxps://lending-online.club/
  • hxxps://controlcenterios.club/
  • hxxps://callerids.club/
  • hxxps://carracer.club/
  • hxxps://streetracingg.club/
  • hxxps://checkheart.club/
  • hxxps://keyboardthemes.club/
  • hxxps://whatsmesticker.club/
  • hxxps://batterychargingeffect.club/
  • hxxps://luxoreditor.club/
  • hxxp://lionflix.club/
  • hxxps://amazingvideoeditor.club/
  • hxxps://zodiachand.club/
  • hxxps://zeusalmighty.club/
  • hxxps://pharaohsadventure.club/
  • hxxps://batterylivewallpaperhd.club/
  • hxxps://comqubla.club/
  • hxxps://safelock.club/
  • hxxps://heartrhythm.club/
  • hxxps://easybassbooster.club/
  • hxxps://comphotolab.club/
  • Second-Stage Domain
  • hxxps://678ikmbtui.com/
  • Third-Stage Domains
  • hxxps://safe-link.mobi
  • hxxps://at.gogameportal.club
  • hxxps://activate-your-account-now.com
  • hxxps://continue-to-get-content-now.com
  • hxxps://your-access-here.com
  • hxxps://app.buenosocial.club
  • hxxps://join.crazymob.co
  • hxxps://vl.denrok.space
  • hxxp://www.timpromos.com.br
  • hxxps://campaignmanager.fun.moobig.com
  • hxxps://get-your-access-now.com
  • hxxp://v.mobzones.com
  • hxxp://mt2-sdp4.mt-2.co:8010
  • hxxps://go.whatabookmark.com
  • hxxps://lp.shoopadoo.com
  • hxxps://es.mobiplus.me
  • hxxps://af.to.123games.club
  • hxxps://be.startdownload.mobi
  • hxxps://za.startdownload.mobi
  • hxxp://n.appspool.net
  • hxxps://wap.trend-tech.net
  • hxxps://fr.chillaxgames.mobi
  • hxxps://tracking.hexilo.com

ABOUT ZIMPERIUM

Zimperium provides the only mobile security platform purpose-built for enterprise environments. With machine learning-based protection and a single platform that secures everything from applications to endpoints, Zimperium is the only solution to provide on-device mobile threat defense to protect growing and evolving mobile environments. For more information or to schedule a demo, contact us today.

Get started with your Zimperium trial today

Qualified organizations will try zIPS, Zimperium's mobile threat defense solution, for free and receive recommendations on how to immediately remediate issues and alleviate risks. This includes 3 steps:

[gravityform id="2" ajax="true"]