Research

Android SMS Trojan Now Being Delivered via SEO Techniques

Android users searching for pornography on their smart phones could be in for a costly surprise.

During the course of researching the origin for the first SMS Trojan for Android devices, I found a new Android package masquerading as a porn media player but which instead sends SMS messages to premium rate numbers.

The SMS messages cost $6 each and are sent silently in the background without the user’s knowledge.

The latest Android malware (detected as Trojan-SMS.AndroidOS.FakePlayer.b) is being distributed via clever search engine optimization (SEO) techniques, a clear sign that cyber-criminals are making every effort to infect mobile devices. The use of SEO is a significant development that confirms our belief that mobile malware – especially on Android devices – is a potentially lucrative business for malicious hackers.

The code in the latest variant is similar to the first version and I’m pretty sure the same person (or group) is involved in creating and distributing this Trojan. It is currently targeting Android users in Russia.

The fake porn player does not have a user interface. Once installed, it simply drops an icon (an adult-themed photograph) on the smart phone’s screen and starts sending premium SMS messages without the user’s knowledge whenever the app is launched.

The malware is not available in the official Android app store. It is being distributed via Web sites but, with the search engine optimization techniques being used, there is a likelihood this is infecting a lot of users.

Like all Android apps, the user is prompted to manually install and allow the application to access certain parts of the operating system. This should serve as an immediate warning, especially since media players should not require access and permission to send SMS messages.

As I said in my previous blog entry on this topic, Android users should pay close attention to the services an application requests to access. Automatically permitting a new application to access every service it requests means you could end up with malicious or unwanted applications doing all sorts of things without requesting any additional confirmation. And you won’t know anything about it.

Android SMS Trojan Now Being Delivered via SEO Techniques

Your email address will not be published. Required fields are marked *

 

Reports

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Andariel evolves to target South Korea with ransomware

In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. After a deep analysis, we came to a conclusion: the Andariel group was behind these attacks.

Subscribe to our weekly e-mails

The hottest research right in your inbox