It combines native code obfuscation, Firebase-based remote execution, VPN-based traffic manipulation, and WebView-based phishing to systematically harvest sensitive user data. The infection begins with a deceptive “Update Required” screen and progresses through VPN activation, silent installation of a hidden APK, and extensive permission abuse. Once deployed, the secondary payload enables SMS interception, call control, USSD execution, and structured credential theft through staged phishing interfaces. Exfiltrated data is encrypted locally and transmitted to a remote backend hosted at https[:]//jsonapi[.]biz, while critical configuration values are hidden inside a native .so library to hinder analysis and detection.