{"id":7842,"date":"2012-08-21T09:40:20","date_gmt":"2012-08-21T15:40:20","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=7842"},"modified":"2018-01-30T09:43:47","modified_gmt":"2018-01-30T16:43:47","slug":"french-android-users-hit-again-by-sms-trojan","status":"publish","type":"post","link":"https://www.webroot.com/blog/2012\/08\/21\/french-android-users-hit-again-by-sms-trojan\/","title":{"rendered":"French Android Users Hit again by SMS Trojan"},"content":{"rendered":"<p>Earlier this year, the SMS Trojan <em>Foncy<\/em> was discovered targeting French-speaking Android Users. Now, we\u2019ve come across a new Trojan targeting them using a similar SMS scam.\u00a0 The app pretends to be an app called BlackMart Alpha, which is already a little shady since it\u2019s used to download apps that may otherwise cost money. This app is not found on Google Play and is not malicious in itself, but the fact that you can\u2019t get it in the Google Play store makes it a prefect target for malware developers to make fake versions of it. Webroot detects this Trojan as <em>Android.SMS.FakeB-Mart<\/em>. \u00a0It works by sending premium SMS messages to two different numbers (81211 and 81038), which have both been involved with scams that add a hefty Euro charge to the victim\u2019s phone bill. In one case, someone was scammed out of \u20ac89.85 , or $110.49. Once the malicious app is installed, it looks like the legitimate BlackMart Alpha app, but doesn\u2019t completely load. A pop-up box opens stating that it\u2019s loading with a increasing percentage. This tricks the user into thinking the app is loading while it\u2019s really sending premium SMS messages in the background.<\/p>\n<p><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/08\/1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-medium wp-image-7843\" title=\"1\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/08\/1.png?w=203\" alt=\"\" width=\"203\" height=\"300\" \/><\/a><\/p>\n<p><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/08\/22.png\"><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-7847\" title=\"2\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/08\/22.png\" alt=\"\" width=\"684\" height=\"152\" \/><\/a><\/p>\n<p><span style=\"color: #333333;\">The app deletes any incoming SMS messages from 81211 to hide any confirmation SMS messages.<\/span><\/p>\n<p><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/08\/31.png\"><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-7848\" title=\"3\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/08\/31.png\" alt=\"\" width=\"736\" height=\"355\" \/><\/a><\/p>\n<p><span style=\"color: #333333;\">Being tricked by this fake blackmarket app when trying to download pirated apps could end up being a lot more expensive than just paying for the app from a trusted app market. Another lesson to always install apps from trusted markets.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Earlier this year, the SMS Trojan Foncy was discovered targeting French-speaking Android Users. Now, we\u2019ve come across a new Trojan targeting them using a similar SMS scam.\u00a0 The app pretends to be an app called BlackMart Alpha, which is already a little shady since it\u2019s used to download apps that may otherwise cost money. This [&hellip;]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[11621,21785,8631,5109,11625,11619,4481,4837,5093,6675,8029,10199,10195,10203,10201,10197,8709,10031,11623,4143],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/7842"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=7842"}],"version-history":[{"count":3,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/7842\/revisions"}],"predecessor-version":[{"id":23476,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/7842\/revisions\/23476"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=7842"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=7842"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=7842"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=7842"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}