Massive SMS stealer campaign infects Android devices in 113 countries
BleepingComputer
|
Contributed by: Reid Stephan
Summary
A recent cybercriminal campaign has been identified that targets Android devices globally, using thousands of Telegram bots to distribute SMS-stealing malware aimed at intercepting one-time 2FA passwords for over 600 services. Researchers at Zimperium have tracked this operation since February 2022, uncovering 107,000 distinct malware samples linked to the campaign, which is primarily driven by financial motives. The malware is disseminated through deceptive ads and Telegram bots, which lure victims with promises of pirated apps, subsequently hijacking SMS messages to steal OTPs and facilitate authentication for illicit activities. Most victims are in India and Russia, with significant cases also in Brazil, Mexico, and the U.S. Infected devices are unwittingly used to provide anonymization services for online interactions, leading to potential unauthorized charges and legal implications for the victims. Users are advised to exercise caution by avoiding APKs from outside Google Play, restricting app permissions, and keeping Play Protect active.
