Premium Panel Fraud

Free Fire game top-up / “follower” panel fraud apps (pkg com.premiumPanel.follower), built with Sketchware. No custom C2 server: a Firebase Realtime Database project is the entire serverless backend. RTDB nodes: Price (product catalog shown in MainActivity), Normal (pending-order queue - each order stores the device id, price, time/date, buyer name and a ‘Tock’ token, status “Pending…..”), DONE (fulfilled orders), and Report (ReportActivity writes the device id via getDeviceId()/android_id plus a free-text complaint). PayActivity collects payment through a live Razorpay checkout key and a UPI QR (generated via quickchart.io), writes the order to Normal, then fires an FCM push to the operator. Promoted via Telegram/YouTube (Follower666FF). Not a RAT/spyware: requests only internet/storage/overlay/FCM, no SMS/contacts/location/accessibility, and performs no device control or bulk exfil. Notable: each APK hardcodes the project’s Firebase Admin SDK service-account PRIVATE KEY in PayActivity (to send FCM), which leaks full administrative control of the operator’s Firebase project. Observed backends: getaway-payment-2026final, september-premium-panel2026.