Android SMS Trojan Now Being Delivered via SEO Techniques

Android users searching for pornography on their smart phones could be in for a costly surprise.

During the course of researching the origin for the first SMS Trojan for Android devices, I found a new Android package masquerading as a porn media player but which instead sends SMS messages to premium rate numbers.

The SMS messages cost $6 each and are sent silently in the background without the user’s knowledge.

The latest Android malware (detected as Trojan-SMS.AndroidOS.FakePlayer.b) is being distributed via clever search engine optimization (SEO) techniques, a clear sign that cyber-criminals are making every effort to infect mobile devices. The use of SEO is a significant development that confirms our belief that mobile malware – especially on Android devices – is a potentially lucrative business for malicious hackers.

The code in the latest variant is similar to the first version and I’m pretty sure the same person (or group) is involved in creating and distributing this Trojan. It is currently targeting Android users in Russia.

The fake porn player does not have a user interface. Once installed, it simply drops an icon (an adult-themed photograph) on the smart phone’s screen and starts sending premium SMS messages without the user’s knowledge whenever the app is launched.

The malware is not available in the official Android app store. It is being distributed via Web sites but, with the search engine optimization techniques being used, there is a likelihood this is infecting a lot of users.

Like all Android apps, the user is prompted to manually install and allow the application to access certain parts of the operating system. This should serve as an immediate warning, especially since media players should not require access and permission to send SMS messages.

As I said in my previous blog entry on this topic, Android users should pay close attention to the services an application requests to access. Automatically permitting a new application to access every service it requests means you could end up with malicious or unwanted applications doing all sorts of things without requesting any additional confirmation. And you won’t know anything about it.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.