The disguised apps use WebView automation, JavaScript injection, and OTP interception to avoid detection and complete fraudulent subscriptions.
Fake Android Apps Commit Carrier Billing Fraud for Premium Services
Summary + source link. No paywalls, no tracking.