Russian SMS Trojan for Android hits US, dozens of other countries

Android malware that sends text messages to premium-rate numbers expanded globally over the past year, researchers warn

An Android Trojan app that sends SMS messages to premium-rate numbers has expanded globally over the past year, racking up bills for users in over 60 countries including the U.S., malware researchers from Kaspersky Lab said.

The malware program, which Kaspersky products detect as Trojan-SMS.AndroidOS.FakeInst.ef, dates back to February 2013 and was originally designed to operate in Russia.

The Trojan disguises itself as an application for watching porn videos, but once installed on a device it downloads an encrypted configuration file and starts sending SMS messages to predefined premium-rate numbers, depending on the user's mobile country code.

For example, when the malware encounters mobile country codes -- special codes used by carriers to identify mobile networks in different countries -- in the range of 311 to 316, which correspond to the U.S., the malware sends three messages that cost $2 each to 97605, the Kaspersky researchers said in a blog post Wednesday.

The malware can also intercept incoming messages and can receive commands from command-and-control servers to send specific text messages to particular phone numbers.

The Kaspersky researchers have identified 14 different versions of Trojan-SMS.AndroidOS.FakeInst.ef and determined that the malware has spread to 66 countries.

"This particular program was the first SMS Trojan to reach users in the U.S.," said Roman Unuchek, senior malware analyst at Kaspersky Lab via email.

According to the antivirus vendor's statistics, the number of Trojan-SMS.AndroidOS.FakeInst.ef victims in the U.S. is still low, with the largest number of infections being recorded in Russia and Canada.

Cybercriminals have used premium-rate SMS Trojans for years to steal money from Android users in China, Russia and other countries where the use of non-official app stores is common. However, Trojan-SMS.AndroidOS.FakeInst.ef and another widespread Trojan called Trojan-SMS.AndroidOS.Stealer.a, which has support for 14 countries, suggest a global escalation for this type of threat.

"It appears that the cybercriminals have built up sufficient resources to expand their illegal business on a global scale," Unuchek said.

The Kaspersky researchers did not clarify how the rogue apps that carry this Trojan are being distributed. The apps are not likely downloaded from Google Play, because Google has gotten much better at policing its app store in recent years. So Android users are probably affected after specifically configuring their phones to allow the installation of apps from "unknown sources."

Many users might have that setting enabled because it's needed to install some legitimate applications that can't be distributed through Google Play for policy reasons -- for example some online poker clients. In addition, attackers could also use social engineering techniques to trick users into enabling support for unknown app sources.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Googlesecuritymobile securityspywaremalwarekaspersky labfraud

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?