“Congratulations, you won!” would normally be a welcome phrase to see when you go online, instantly making you think of an all-expenses-paid vacation someplace exotic, or perhaps a substantial amount to add a few more zeroes to your bank account. If only it weren’t a favorite phrase among scammers too, you could actually already be on your way somewhere nice and sunny.

We have recently seen such “You won” scams increasingly being adopted by mobile threat actors on Android. We’ve been seeing queries from our end users and samples from our partners in the field growing significantly since the summer.