New variants of premium rate SMS trojan 'RuFraud' detected in the wild

New variants of premium rate SMS trojan 'RuFraud' detected in the wild

Summary: Researchers from AegisLab, have intercepted several new variants of the infamous RuFraud premium rate SMS trojan.

SHARE:

Researchers from AegisLab, have intercepted several new variants of the infamous RuFraud premium rate SMS trojan.

How the infection takes place:

In order to earn money from the premium-rate SMS, the trojan will fake itself as a famous app, like Angry Birds; or downloader/installer of well-known softwares, it looks like 'real thing'. Some of these kinds of apps appear on the third-party download sites, and some will repackage itself, post to the official Android Marketplace, and try to lure innocent people to install it.

The malicious attackers have bundled the premium rate SMS trojan into a fake copy of the popular app Angry Birds. Upon execution, the trojan seems permissions to sent SMS messages. Once the user confirms that the application is free to do so, the trojan will start sending premium rate SMS messages to multiple numbers outlined in AegisLab's post.

Topics: Telcos, Collaboration, Hardware, Malware, Mobility, Networking, Security

Dancho Danchev

About Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

7 comments
Log in or register to join the discussion
  • RE: New variants of premium rate SMS trojan 'RuFraud' detected in the wild

    "Once the user confirms..." UAC ?
    Return_of_the_jedi
  • RE: New variants of premium rate SMS trojan 'RuFraud' detected in the wild

    Good thing WP7 protects the users from things like this. Crapple, and Gagged, crap OSs will allow this to harm users due to those OSs having crap for security, while WP 7 has much better security.
    Stephen-B
    • RE: New variants of premium rate SMS trojan 'RuFraud' detected in the wild

      @Stephen-B Still trying to pass yourself off as a security expert, eh sonny?
      'Fraid not, as usual.
      radleym
      • RE: New variants of premium rate SMS trojan 'RuFraud' detected in the wild

        @radleym you're still a troll. Why haven't you been banned?. You do not add anything constructive, just thr typical ABM rants an insults. Are you that jerk RickK?
        Stephen-B
  • ANDROID, ANDROID TROJAN, THIS IS ANDROID

    Just compensating for leaving Android out of the title.<br><br>Funny how WP7 and Apple always get mentioned if there are problems, but in this case, they don't have to worry, do they?
    tonymcs@...
    • RE: New variants of premium rate SMS trojan 'RuFraud' detected in the wild

      @tonymcs@... your only safe bet is to use WP 7 phones, as they are te only ones safe from this virus.
      Stephen-B
  • Asus

    <br><strong><a href="http://www.havebattery.com/advent-laptop-battery-c-90.html ">Advent battery</a></strong><br><strong><a href="http://www.havebattery.com/advent-laptop-battery-c-90.html ">cheap Advent battery</a></strong><br><strong><a href="http://www.havebattery.com/advent-laptop-battery-c-90.html ">Advent laptop</a></strong><br><strong><a href="http://www.havebattery.com/advent-laptop-battery-c-90.html ">laptop battery</a></strong><br><strong><a href="http://www.havebattery.com/advent-laptop-battery-c-90.html ">Advent laptop battery</a></strong><br><strong><a href="http://www.havebattery.com/hp-laptop-battery-c-42.html ">HP Battery</a></strong><br><strong><a href="http://www.havebattery.com/nec-laptop-battery-c-82.html ">NEC</a></strong><br><strong><a href="http://www.havebattery.com/hp-laptop-battery-c-42.html ">HP</a></strong><br><strong><a href="http://www.havebattery.com/laptop-ac-adapters-c-74.html ">laptop adapters</a></strong><br><strong><a href="http://www.havebattery.com/hp-laptop-battery-c-42.html ">HP laptop battery</a></strong>. <br><br><a href="http://blog.funnyuggboots.com"> Asus blog </a><br><br><a href="http://blog.watchesonlinesell.com"> Asus </a><br><br><a href="http://blog.superswarovski.com"> About havebattery.com blog </a>
    newhardandr