SMS Trojans target users from a number of European countries and Canada
Denis @Kaspersky Lab discovered a SMS Trojan that target users from a number of European countries and Canada. According to the messages found on Internet forums, the first infections were reported in early September.
One of the Victim downloaded an application to monitor his own messages, calls and traffic. After launching this application , it displayed message that it was not compatible with the user’s Android version. And then the user’s mobile account was emptied. This app turned up to be an SMS Trojan which sends 4 SMS messages to premium rate numbers. Kaspersky detect it as "Trojan-SMS.AndroidOS.Foncy" malware.
The main menu of smartphone after the infection:
One of the Victim downloaded an application to monitor his own messages, calls and traffic. After launching this application , it displayed message that it was not compatible with the user’s Android version. And then the user’s mobile account was emptied. This app turned up to be an SMS Trojan which sends 4 SMS messages to premium rate numbers. Kaspersky detect it as "Trojan-SMS.AndroidOS.Foncy" malware.
The main menu of smartphone after the infection:
This Trojan is distributed via a file hosting website with the name "SuiConFo.apk".
There are 2 main malicious classes of this Trojan: ‘MagicSMSActivity.class’ and ‘SMSReceiver.class’. The first is mainly responsible for sending SMS messages, while the second is used to hide incoming messages from specific numbers.
"Unfortunately, today SMS Trojans are one the easiest ways for cybercriminals to make easy money fast. Malicious use of premium rate SMS services is spreading around the world, and I’m pretty sure it’s not going to stop any time soon. We’ll keep you posted. " said Denis