Nasty advertising threatens Android and iOS devices: malware is distributed via URL shorteners and the calendar function is abused. As a result, premium SMS are often sent and subscriptions are taken out. An analysis by ESET researchers.
According to ESET researchers, aggressive advertising that distributes dangerous malware is currently up to mischief. In addition, the malware creates alleged events in iOS and Android calendars. These advertisements often cost victims money as premium SMS messages are sent and subscriptions are taken out.
Android as well as iOS devices are affected
With Android, there is a risk of banking and SMS Trojans or malicious applications getting onto the devices. Android / FakeAdBlocker, as malware is called, usually hides its launcher icon and delivers unwanted scareware or pornographic advertisements. According to the ESET researchers, this malicious app alone was downloaded more than 1 times on Android devices between January 1 and July 2021, 150.000. Most of the people affected came from Russia, the USA, Mexico and Germany. Hundreds of other malicious programs were also downloaded. The security experts have now published their analysis on WeLiveSecurity.
Many malicious apps outside of Google Play
“Our telemetry data shows that many users download Android apps outside of Google Play. Often they get to malicious apps that are distributed through aggressive advertising practices and generate income for the cybercriminals. The current campaign is particularly dangerous for Android users, ”explains Lukas Stefanko, the ESET researcher who analyzed Android / FakeAdBlocker. “There are 18 events in the calendars that take place every day and last 10 minutes each. Their names and descriptions suggest that the victim's smartphone is infected with malware, personal information has been released, or the anti-virus apps have expired. The descriptions of the events each contain a link that takes the victim to a scareware advertising website. This website again claims that the device has been infected and offers the user the option of downloading shady cleaning applications from Google Play. "
Great danger for Android users
The situation is even more dangerous for those affected who use an Android smartphone or tablet. The deceptive websites offer malicious apps for download outside of the Google Play store. In one scenario, the website asks to download an application called "adBLOCK", which has nothing to do with the legitimate application and does the opposite of ad blocking. In another scenario, while downloading the requested file, victims are presented with a web page that describes the steps to download and install a malicious application named “Your File Is Ready To Download”. In both scenarios, a scareware ad or the Android/FakeAdBlocker Trojan is delivered via a URL shortening service. But not only the Android/FakeAdBlocker was distributed, but also, for example, the banking Trojan Cerberus, which was disguised as an update for Chrome or Android and Adobe Flash Player.
Link shortener services use aggressive advertising techniques
ESET researchers have identified link shortener services that place appointments on iOS calendars and spread the Android / FakeAdBlocker malware that can be launched on Android devices. On iOS devices, these links not only flood victims with unwanted advertisements, but can also create events on victims' calendars by automatically downloading an ICS calendar file. “When someone clicks on such a link, they'll see an ad that generates revenue for the person who created the shortened URL. The problem is that some of these link shortener services use aggressive advertising techniques such as scareware advertising that informs users that their devices are supposedly infected with dangerous malware, ”explains Lukas Stefanko.
More at ESET.com
About ESET ESET is a European company with headquarters in Bratislava (Slovakia). ESET has been developing award-winning security software since 1987 that has already helped over 100 million users enjoy secure technology. The broad portfolio of security products covers all common platforms and offers companies and consumers worldwide the perfect balance between performance and proactive protection. The company has a global sales network in over 180 countries and branches in Jena, San Diego, Singapore and Buenos Aires. For more information, visit www.eset.de or follow us on LinkedIn, Facebook and Twitter.