Researchers at Pradeo have observed a new Android malware campaign that uses text messages asking victims to pay a small fee for a delivery. The messages contain a link that will install a phony, malicious version of Google Chrome. The victims are also asked to enter their payment details, which are sent to the attackers.
“Our team has come across an advanced mobile attack campaign that uses a phishing technique to steal victims’ credit card details and infects them with a malware that impersonates the Android Google Chrome app,” the researchers write. “The malware uses victims’ devices as a vector to send thousands of phishing SMS. Pradeo’s researchers qualified it as a Smishing trojan. By combining an efficient phishing technique, a malware to propagate actively, and methods to bypass security solutions, this campaign is particularly dangerous. We evaluate that the speed at which it is spreading has enabled it to already target hundreds of thousands of people in the last weeks. “
The malware spreads via smishing messages sent from infected phones, which racks up victims’ phone bills.
“Independently, once installed, the fake Chrome app sends more than 2000 SMS per week from its victims’ devices, every day during 2 or 3 hours, to random phone numbers that seem to follow one another,” Pradeo says. “This mechanism ensures a successful propagation of the attack campaign. To stay undetected, the malware hides on mobile devices by using the official Chrome app’s icon and name, but its package, signature and version have nothing in common with the official app. For victims, banking fraud and massive phone bills may ensue.”
The researchers stress that users should constantly be on the lookout for unsolicited messages asking for sensitive information.
“Mobile users should never provide credit card details when it is requested by an unknown sender,” Pradeo concludes. “If uncertain of the source of the request, they should consult their package delivery with the tracking number provided by the carrier, on the official app or the website. Besides, they should exclusively download apps from official stores (Google Play on Android and the Apple store on iOS) and always update them from there.”
It’s a self-propagating scam with a few revenue streams, starting with the chickenfeed charged to release the package-that-isn’t and progressing through various forms of fraud. New-school security awareness training can help your employees recognize social engineering attacks.
Here's how it works:
