#FAKE APP ICONS UPDATE#
#FAKE APP ICONS CODE#
#FAKE APP ICONS DOWNLOAD#

“There is no premium-number fraud performed at the moment, but as the app loads external code and already asks for the proper permissions to send SMS, it could do it,” Suau said. Pradeo researchers think that banking fraud and massive phone bills may ensue for victims, in addition to the credential theft. Suau added that users will end up with two Chrome apps, but one is the fake one. Meanwhile, the malware hides on mobile devices by using the official Chrome app’s icon and name, “but its package, signature and version have nothing in common with the official app,” according to the analysis. “Every time someone falls victim, it greatly multiplies the propagation.” “Every device hosting the malware automatically sends 300 phishing SMS per day,” Suau said. The recipient phone numbers are simply random, not from the victims’ phone books, but seem to follow a sequential pattern, researchers said. The messages are sent out on a daily cadence, during certain two- or three-hour blocks, silently in the background. The fake Chrome app is used as a propagation method: Once installed, it sends more than 2,000 SMS messages per week from infected devices, Pradeo found.

But at the rate it propagates, it could spread far beyond that initial geography. The campaign came to light at the beginning of May and has been observed in several European countries, Suau noted. “All the techniques (code concealment, smishing, data theft, repackaging…) used separately are not advanced, but combined they create a campaign that is hard to detect, that spreads fast and tricks many users.” “The attack could be the work of a regular level but very ingenuous cybercriminal,” Pradeo’s Roxane Suau told Threatpost.

#FAKE APP ICONS DOWNLOAD#

“They take advantage of that familiarity to get mobile users to download malicious apps that are masked as legitimate ones.”īy combining an efficient phishing technique, the propagation malware and several security-solutions bypasses, the campaign is particularly dangerous, Pradeo researchers noted. “Attackers know that we’re accustomed to receiving alerts of all types on our smartphones and tablets,” Hank Schless, senior manager of security solutions at Lookout, told Threatpost. In reality, it’s the malware, which is downloaded to their phones.Īfter the supposed “update,” victims are taken to a phishing page that closes the loop on the social engineering: They’re asked to pay a small-dollar amount (usually $1 or $2 dollars) in a less-is-more approach, which is of course just a front to harvest credit-card details, according to the analysis, issued Monday. If they accede to that request, they’re taken to a malicious website hosting the purported app.

#FAKE APP ICONS UPDATE#

If they fall for it and click, a message comes up asking them to update the Chrome app. Join Threatpost for “ Fortifying Your Business Against Ransomware, DDoS & Cryptojacking Attacks” a LIVE roundtable event on Wednesday, May 12 at 2:00 PM EDT for this FREE webinar sponsored by Zoho ManageEngine.Īccording to researchers at Pradeo, the attack starts with a basic “smishing” gambit: Targets receive an SMS text asking them to pay “custom fees” to release a package delivery.

2022.09