New Android Malware Disguises Itself as a Settings App, Steals SMS Messages

Vinay Pidathala, Hitesh Dharmdasani, Jinjian Zhai and Zheng Bu write:

FireEye has uncovered and helped weaken one of the largest advanced mobile botnets to date. The botnet, which we are dubbing “MisoSMS,” has been used in at least 64 spyware campaigns, stealing text messages and emailing them to cybercriminals in China.

MisoSMS infects Android systems by deploying a class of malicious Android apps. The mobile malware masquerades as an Android settings app used for administrative tasks. When executed, it secretly steals the user’s personal SMS messages and emails them to a command-and-control (CnC) infrastructure hosted in China. FireEye Mobile Threat Prevention platform detects this class of malware as “Android.Spyware.MisoSMS.”

2 thoughts on “New Android Malware Disguises Itself as a Settings App, Steals SMS Messages”