SMS Trojans Using Adult Content On The Rise In Android

by

Share this news now.

In the marketing world, it’s widely known sex sells. This is so true the “adult” industry is a multi-billion dollar industry. This is also why malware authors have long used adult content to attract unwitting victims. Lately, this threat researcher has seen way too much of it. There has been an influx of Trojan-like APKs using adult content to trick users into sending premium SMS messages. Let’s take a deeper look at one of these apps.

When you open the app it displays a page showing “GET IT NOW” in the middle, and “NEXT” at the lower right corner. If you tap “GET IT NOW”, it pops up a message saying “Request sent. Thank You”, and goes to the next screen. If you press “NEXT”, it goes to the next screen without a message. After several screens like this, it eventually gets to the last screen which may or may not have several buttons, but always has “T&C”, which I can only guess means “Terms & Conditions”. This opens up an SMS agreement screen.

1 2

 

Using Google translate, the SMS agreement – which is in Indonesian – roughly translates to this:

Subscribe to a few videos now! Click on the mobile, you will be a customer subscription and retrievable content, cost RM3.00/SMS caj, 1-2 day per SMS (not including GPRS caj so canceled). To deselect, sms STOP conductivity to 39 997. Talian CS: 03-7493 1352 (Isnin to Friday). By concatenated, you agree with the terms and conditions that presented.

Click “OK” and you’ll be charged via premium SMS. So what about the “content” that’s promised? Sorry, not going to happen.

Not all, but quite a few of these apps are using the same package name pattern:

com.<naughty_word>.kma2
com.<naughty_word>.gmb2
com.<naughty_word>.lmt2
com.<naughty_word>.ymb2
com.<naughty_word>.mbf2

When looking for “content” out there, be smart about it. If an app is asking you to agree to subscribe to something via premium SMS messages, think twice. Of course, it always helps to have a malware scanner on your phone, like Webroot SecureAnywhere Mobile, as well.


Share this news now.
SMS Trojans Using Adult Content On The Rise In Android by

Tags:



About the Author

Name: Nathan Collier
Role: Threat Team Member

Share this news now.

Nathan is a Senior Threat Research Analyst for Webroot, having been with the company since October 2009.  He started has career working on PC malware, but now spends most of his time in the mobile landscape researching malware on Android devices.  Because of his early adaptation to mobile security, Nathan has seen the exponential growth of mobile malware and is highly experienced in protecting Webroot customers from mobile threats. He also enjoys frequently traveling with his flight attendant wife, Megan, and is a competitive endurance mountain bike racer in Colorado.


Share this news now.
SMS Trojans Using Adult Content On The Rise In Android by