I have encountered a mobile application named "HTTP Injector" which lets you get free internet access (UBT / FBT).
The process to get it work and receive free internet seems to be as follows:
Guidance videos on YouTube show that an end user needs to have a VPN server with SSH set up.
The end user then needs to find an open HTTP proxy using a common website like hidemyass.com
The HTTP Injector application generates a "payload" which is actually a "HTTP CONNECT" request to the proxy.
The HTTP Injector is loaded with the credentials and configuration needed for initiating an SSH connection to the VPN server.
The "payload" with the CONNECT method is sent via SSH (somehow, maybe SSH tunneling) and...
The end user is then able to move from the WiFi connection back to Cellular Data.
How does this works? How does the SSH connection keep alive over a SIM with no cellular data quota left? Moreover, How does the VPN server knows how to forward the request to the proxy? And how come this haven't been prevented yet?