Zimperium Reveals Android Malware: SMS Stealer Targets Corporate Networks

Over 105,000 Malware Samples Identified

Key Findings:

• Over 95% are/were unknown and unavailable malware samples

• Malware hijacked OTP text messages across more than 600 global brands

• Approx. 4,000 samples contained phone numbers pre-embedded within Android kit

• 13 C&C servers used to communicate and potentially receive stolen SMS messages

• Over 2,600 Telegram bots linked to campaign, serving as a distribution channel

Zimperium, the leading global provider of mobile security solutions, announces the discovery of a new and potent threat identified as the SMS Stealer. This malicious software, uncovered by Zimperium’s zLabs team during routine malware analysis, has been identified in over 105,000 samples, across more than 600 global brands, highlighting its extensive reach and significant risks, including account takeovers and identity theft.

Also Read: The Evolution of Private Cloud: Addressing Modern Enterprise Needs

The SMS Stealer threat, first identified in 2022, uses fake ads and Telegram bots posing as legitimate services to trick victims into gaining access to their SMS messages. Once access is granted, the malware connects to one of its 13 Command and Control (C&C) servers, confirms its status, and begins transmitting stolen SMS messages, including one-time passwords (OTPs).

OTPs are designed to add an extra layer of security to online accounts, particularly for enterprises controlling access to sensitive data. However, the SMS Stealer’s ability to intercept OTPs undermines this security feature, giving bad actors the means to gain control of victims’ accounts. The malware associated with SMS Stealer remains hidden, allowing for continuous attacks.

The Impact of SMS Stealer:

• Credential Theft: The malware can intercept and steal OTPs and login credentials, leading to complete account takeovers.
• Malware Infiltration: Attackers may use stolen credentials to infiltrate systems with additional malware. Increasing scope and severity of attack.
• Ransomware Attacks: Stolen access can be leveraged to deploy ransomware, leading to data encryption and significant financial demands for data recovery.
• Financial Loss: Attackers can make unauthorized charges, create fraudulent accounts, and facilitate significant financial theft and fraud.

Also Read: Intel’s Lunar Lake Processors: Arriving Q3 2024

“The SMS Stealer represents a significant evolution in mobile threats, highlighting the critical need for robust security measures and vigilant monitoring of application permissions,” said Nico Chiaraviglio, Chief Scientist at Zimperium. “As threat actors continue to innovate, the mobile security community must adapt and respond to these challenges to protect user identities and maintain the integrity of digital services.”

[To share your insights with us as part of editorial or sponsored content, please write to psen@itechseries.com]