Android Trojan Hits Multiple Countries

Thursday, April 24, 2014 @ 03:04 PM gHale

As if there is a big surprise when it comes to threats against Android devices, but there is a new and improved attack out there that is a SMS Trojan designed to target users in quite a few different countries.

The Trojan, called Trojan-SMS.AndroidOS.FakeInst.ef, first caught researchers’ eyes in February 2013 and over a dozen new versions released since then, said officials at Kaspersky Lab.

Trojan Proliferates on Android
Android Trojan Relies on Inattentive Users
Android Trojan Spreads through Botnet
3rd Party Apps a Bug Nightmare

The first variants only sent SMSs to premium rate numbers in Russia. However, cybercriminals kept adding more and more countries to the list, until they reached 66.

While most of the infections have been observed in Russia and Canada, countries like the U.S., Germany, Lithuania, France, Finland, Norway, Ukraine, the UK, Malaysia, Hungary, Switzerland, Indonesia, Spain, Israel, Portugal, Ireland, China, the Czech Republic, the Netherlands, New Zealand, and Brazil also feel the pain.

Attackers distribute the Trojan by disguising it as an app that allows users to access adult videos.

The configuration file contains a list of phone numbers and prefixes. Based on the victim’s location, messages go out from the infected devices to premium rate numbers. For each message, victims end up charged around $2.

In addition to sending SMSs, the malware is also capable of intercepting incoming text messages.

Leave a Reply

You must be logged in to post a comment.