In the middle of July I wrote about porn SMS senders which covertly subscribed users to a range of premium-rate services with the promise of raunchy images. These applications were targeting users from the US, Malaysia, the Netherlands, the UK, Kenya and South Africa. At the end of that blog post I wrote that ‘…the appearance of several applications which use premium rate SMS messages and target users from completely different countries leads us to the conclusion that it’s no longer just a problem in Russia and China, unfortunately’.
Now this problem has evolved to SMS Trojans which target users from a number of European countries and Canada. Yes, these SMS Trojans don’t target either Russian or Chinese smartphone users.
According to the messages we found on Internet forums, the first infections were reported in early September. Somebody downloaded an application to manage and monitor his own SMS/MMS messages, calls and traffic. After launching this application it displayed the message that it was not compatible with the user’s Android version. And then the user’s mobile account was emptied.
We tracked down this application and unsurprisingly it turned up to be an SMS Trojan which sends 4 SMS messages to premium rate numbers. We detect it as Trojan-SMS.AndroidOS.Foncy.
It was spread via a file hosting website with the name ‘SuiConFo.apk’. After installation, it appears on the main menu of Android smartphones:
Hiç yorum yok:
Yorum Gönder