Android users at risk of complex multi-step attacks
By Jeph Ajobaju, Chief Copy Editor
Android users have been warned about a “toll fraud” malware that disguises as normal apps on the Google Play Store and drains the wallet of users once installed.
Microsoft describes toll fraud malware as a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent.
This type of malware is one of the most prevalent types of Android malware – and it continues to evolve.
Compared to other subcategories of billing fraud, which include SMS fraud and call fraud, toll fraud has unique behaviours.
Whereas SMS fraud or call fraud uses a simple attack flow to send messages or calls to a premium number, toll fraud has a complex multi-step attack flow that malware developers continue to improve.
“We saw new capabilities related to how this threat targets users of specific network operators. It performs its routines only if the device is subscribed to any of its target network operators,” Microsoft researchers explained in a blog post – https://www.microsoft.com/security/blog/2022/06/30/toll-fraud-malware-how-an-android-application-can-drain-your-wallet/
“It also, by default, uses cellular connection for its activities and forces devices to connect to the mobile network even if a Wi-Fi connection is available.
“Once the connection to a target network is confirmed, it stealthily initiates a fraudulent subscription and confirms it without the user’s consent, in some cases even intercepting the one-time password (OTP) to do so.
“It then suppresses SMS notifications related to the subscription to prevent the user from becoming aware of the fraudulent transaction and unsubscribing from the service.”
________________________________________________________________________
Related articles:
Millions of e-devices worldwide exposed to malware, US warns
Global media outlets working to unravel Pegasus spyware network
Google alerts 2.65b Chrome users about hacking. Apple scrambles to block iPhone spyware
________________________________________________________________________
How it gets to your phone
This type of attack starts when a user downloads an app the malware is disguised as on the Google Play Store.
These trojan apps will usually be listed in popular categories in the app store such as personalisation (wallpaper and lock screen apps), beauty, editor, communication (messaging and chat apps), photography, and tools (like cleaner and fake antivirus apps), says the alert from Microsoft, per reporting by Nairametrics.
According to the researchers, these apps will ask for permissions that don’t make sense for what is being done (that is, a camera or wallpaper app asking for SMS or notification listening privileges).
Protection against toll fraud
Microsoft notes that toll fraud is one of the most common malware categories with high financial loss as its main impact. Due to its sophisticated cloaking techniques, prevention from the side of the user plays a key role in keeping the device secure.
The researchers say the rule of thumb is to avoid installing Android applications from untrusted sources (sideloading) and always follow up with device updates.
They also recommend end-users take the following steps to protect themselves from toll fraud malware:
- Install applications only from the Google Play Store or other trusted sources.
- Avoid granting SMS permissions, notification listener access, or accessibility access to any applications without a strong understanding of why the application needs it. These are powerful permissions that are not commonly needed.
- Use a solution such as Microsoft Defender for Endpoint on Android to detect malicious applications.
- If a device is no longer receiving updates, strongly consider replacing it with a new device.
