Threat taxonomy
medium activityMobile Money FraudFirst seen 2025
USSD Phantom
Aliases: Session hijack kit
Social engineering and overlay tooling that induces customers to approve USSD-initiated transfers while believing they are reversing an erroneous credit.
Attribution
Commodity fraud tooling
Primary targets
- — Retail wallet customers
- — Small merchants
Observed tactics
- Spoofed sender ID notifications
- Voice pretexting as support staff
- Overlay prompts mirroring wallet PIN screens
Regional relevance
Exploits the regional prevalence of USSD transaction flows on feature phones where app-level protections do not apply.
Detection guidance
- Flag reversal-themed inbound calls preceding transfers
- Rate-limit new beneficiaries on USSD channel
- Educate customers on support callback policy
Related feed reporting
- critical13 Sept 2026
SIM swap surge against high-value mobile wallet accounts in Ethiopia and Kenya
- high05 Sept 2026
Android overlay malware rebuilt for East African wallet applications