Hackers Using Faux Cellular Telephone Towers To Spread Android Banking Trojan

Chinese Hackers receive got taken Smishing assail to the adjacent level, using rogue jail Galvanic cell telephone towers to distribute Android banking malware via spoofed SMS messages.

SMiShing — phishing attacks sent via SMS — is a type of assail wherein fraudsters purpose release spoofing assail to ship convincing bogus messages to play a joke on mobile users into downloading a malware app onto their smartphones or lures victims into giving upward sensitive information.

Security researchers at Check Point Software Technologies receive got uncovered that Chinese hackers are using fake base of operations transceiver stations (BTS towers) to distribute "Swearing Trojan," an Android banking malware that in ane lawsuit appeared neutralized afterwards its authors were arrested inwards a constabulary raid.

This is the rootage e'er reported real-world example inwards which criminals played smart inwards such a agency that they used BTS — a slice of equipment commonly installed on cellular band towers — to spread malware.

The phishing SMS, which masquerades itself every bit the ane coming from Chinese telecom service providers PRC Mobile as well as PRC Unicom, contains real convincing text alongside a link to download malicious Android APK.

Since Google Play Store is blocked inwards China, the SMS easily tricks users into installing the APK from an untrusted source.

"Using a BTS to ship faux messages is quite sophisticated, as well as the SMS content is real deceptive. The message tricks users into clicking a malicious URL which installs malware," the researchers said inwards the blog post.

Once installed, the Swearing malware distributes itself yesteryear sending automated phishing SMSes to a victim's contacts.

However the maximum arrive at of a BTS antenna may last every bit depression every bit 10-22 miles, the technique is real successful as well as sophisticated inwards targeted attacks.

Discovered terminal yr yesteryear Tencent Security researchers, the Swearing Trojan has the capability to pocket banking concern credentials as well as other sensitive information from victim Android devices as well as to bypass two-factor authentication yesteryear replacing a user's legit SMS app alongside a malicious version that intercepts incoming SMS messages.

What's to a greater extent than interesting? To avoid detection of whatever malicious activity, the Swearing trojan doesn't connect to whatever remote command-and-control (C&C) server. Instead, it uses SMS or emails to ship stolen information dorsum to the hackers.

"This provides the malware alongside proficient comprehend for its communications as well as hinders attempts to line whatever malicious activity."

While this detail malware stimulate has commonly targeted Chinese users, Check Point researchers warned inwards a weblog post that the threat could rapidly spread worldwide when adopted yesteryear Western malware.

The malware system seems to last larger than previously thought, every bit according to researchers, exclusively 21cn.com e-mail addresses were used inwards the initial malware campaign, spell novel attacks used other pop Chinese e-mail service providers, such every bit 163.com, sina.cn, as well as qq.com, as well as Alibaba Cloud as well as other cloud service hosted e-mail accounts every bit well.

Check Point too points out the nasty HummingBad malware trojan that was too discovered inwards the Chinese mobile market, as well as "turned out to last early on birds which continued to spread worldwide" if adopted yesteryear western malware.

Share This :