[Android General] masury:
If you think you're immune to hackers if you only download legitimate Android apps from Google Play, think again.

Researchers at McAfee Mobile Research have uncovered a new "money-grabbing" campaign, involving at least 15 re-packaged applications that secretly subscribe to paid premium services while users do not pay attention This list includes many applications called "phishing scams" such as Qrcode Scanner, Cut Ringtones 2018 and Despacito Ringtone.

The campaign was launched by AsiaHitGroup Gang, which first appeared in late 2016, targeting the main victims in Thailand and Malaysia. This group uses a fake software installer called Sonvpay.A that downloads and installs popular applications that are not released on Google Play, of course with a certain amount of underlay. . But what is worth mentioning here is that it secretly subscribes to paid services in the background for at least 20,000 victims by sending SMS messages to paid phone numbers.

But that is just the beginning.

The group then "captured" Google Play in November 2017, with the second campaign targeting Thailand, Malaysia, and Russia. They modified the fake installer, naming it Sonvpay.B, to download a fake version of the familiar Google Play app. In this campaign, Sonvpay relies on the geographical location of the IP address to identify the country of origin of the victim. It also uses the same SMS method as the first one, plus the WAP Billing feature - billing directly to the network - to secretly register victims into premium services.

Their third campaign began in January of this year, targeting Android devices that visit Google Play in Malaysia and Kazakhstan. Instead of creating fake applications, the team has incorporated legacy Android applications into Sonvpay.C, allowing it to use silent push notifications in the background to secretly register victims into services. premium paid. Applications themselves do not appear to be dangerous, except for requesting access to SMS. In fact, they work just fine.

"The subscription is primarily made through WAP Billing, which does not require sending SMS messages to premium numbers," said Carlos Castillo of McAfee. "Instead, it only requires users to use the network. Mobile to access a specific website and automatically click a button to launch the registration process. "

Once you install one of the other applications, Sonvpay will receive paid premium subscription services through push notifications that phone users will never see. These services are paid directly to the network. In addition, there is a fake "update" component, which requires the user to agree to allow the application to update, and Sonvpay.C will take advantage of that to register for premium services. Even if the user does not agree, these services will still appear in the network invoice depending on the statement sent through the push message.

The problem with the pay-as-you-go model and this type of scam is that usually, users will not notice until they receive monthly receipts. And because this is a subscription model, the victim will have to find out how to stop subscribing to premium services mentioned above.

When the McAfee team discovered Qrcode Scanner, Cut Ringtone 2018 and Despacito Ringtone were attached to Sonvpay.C, they warned Google and the apps were removed from Google Play. Despacito Ringtone reappears after a few days, once again infected with Sonvpay.C, and again be killed by Google.

Certainly AsiaHitGroup Gang will be back with the 4th campaign. Be wary!

Reference: DigitalTrends