Premium content services were able to exploit a cross-site scripting vulnerability in Telkom’s systems to subscribe customers to their WASP and make it look legitimate.