The malware accesses cellular webpages (payment endpoints) by mobile data and carries out unauthorized payment transactions. Additionally, it steals OTPs used as authentication for transactions.