Kahwin SMS Stealer (provisional)

Wedding-invitation SMS stealer targeting Malaysia (NetbyteSec, June 2023). Distributed over WhatsApp as a fake digital wedding invite (“Kad Digital Kahwin.apk”, “Jemputan-Majlis-Perkahwinan.apk”; app label “Kad Kahwin Digital” / “Undangan Pernikahan”), often throwaway packages such as com.example.myapplication or com.google.*. A ReceiveSMS handler intercepts incoming SMS and forwards the sender, body and device info to a hardcoded Telegram bot via api.telegram.org; a WebView shows a real wedding-invite page (e.g. ejemputan.com, our-wedding.link) as cover. The actionable IOC is the Telegram bot token (recorded as token@chat_id), recovered from the api.telegram.org sink. The invite labels use Indonesian phrasing (“Undangan Pernikahan”); that is lure localization and not by itself an attribution of the operator. Distinct from the generic commodity SMS-forwarder bucket by the consistent wedding-invitation lure. Provisional bucket pending attribution.