Trojan:Android/OpFake, Trojan:Android/OpFake.A, Trojan:Android/OpFake.D, Trojan:SymbOS/OpFake.A, Trojan:SymbOS/OpFake.B, Trojan:WinCE/OpFake.A


Variants in the OpFake family send SMS messages to premium-rate numbers.


Automatic action

Once the scan is complete, the F-Secure security product will ask if you want to uninstall the file, move it to the quarantine or keep it installed on your device.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

The OpFake malware family include variants that operate on the Android, Symbian and Windows Mobile platforms. All variants essentially sends SMS messages to premium-rate numbers.

The first variant, OpFake.A is disguised as an Opera Mini web browser updater, to the extent of adding an Opera icon on the menu and displaying a fake download progress bar to make it appear that the application is actually downloading, and a fake license.

In addition to sending out SMS messages to premium-rate numbers, the malware also monitors SMS messages and is capable of deleting/moving messages based on the originating phone numbers and message content. Subsequent variants share similar technical details.

This malware is also discussed in the following Labs Weblog post:


  • Trojan:Android/OpFake.A
  • Trojan:Android/OpFake.D
  • Trojan:Android/OpFake.E
  • Trojan:Android/OpFake.F


This malware is discussed in further detail in:

Date Created: -

Date Last Modified: -