BEWARE - Rogue Android apps flood into alternative markets

Summary:Send premium rate text messages to get free software.

Android users beware ... the bad guys are now building convincing-looking Android markets pushing rogue Android apps and malware.

According to security firm Webroot, a lot of effort has been put into these sites.

These well-crafted websites follow a similar layout; they have device reviews, app descriptions with screenshots, QR Codes and FAQs. So far, we've only found these websites aimed at Russian users, with the web pages written in Russian. The descriptions are similar to those in the Android Market and the screenshots appear to be taken from the market. We are discovering that this network of SMS Trojans is fairly large.

These Trojans, which Webroot is calling Android.SMS.FakeInst, come in a number of variants but all have one purpose - to scam unwitting users into sending three premium rate text messages in exchange for an app.

The catch ... most of the apps are either available for free from the Google Android Marketplace or are fake apps which don't work. These apps also ask for a whole range of permissions - READ_PHONE_STATE, SEND_SMS, RECEIVE_SMS and INTERNET - which would essentially given then access to the whole handset.

Be careful out there!


Topics: Developer, Mobility


Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.Adrian has authored/co-authored technic... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.