The Lookout Blog

Android Trojan Aims to Make Money Through Premium Rate Text Message Charges

With billions of people around the globe relying on their smartphones and tablets everyday, malware writers are looking for ways to profit from the growing mobile market.  In June, Lookout uncovered and blocked GG Tracker, sophisticated Android malware designed to steal money through premium text messages. This week, another Trojan targeting Android phones was reported that has the ability to send premium-rate text messages to specific phone numbers in Canada and Europe. Researchers claim that the Trojan, Trojan-SMS.AndroidOS.Foncy, disguises itself as an app for monitoring SMS messages and calls.  Reportedly, Foncy is spread through a file-hosting website, and when someone installs the app on their phone, the Trojan sends four text messages to predefined premium-rate numbers that correspond to their SIM card’s country, including Germany, Spain, France, Belgium, Luxembourg, Switzerland, UK and Canada.

While early instances of malware using premium-rate SMS targeted mobile users in Russia and China, we’re now seeing this type of malware affect mobile users worldwide.  Luckily, there are a number of steps mobile device users can take to stay safe:

• Only download apps from trusted sources, such as reputable app stores and download sites. Read through the permissions, and remember to look at the developer name, reviews and star ratings.
• Be alert for unusual behaviors on your phone, which could indicate that your phone is infected. These behaviors may include unusual text messages, strange charges to your phone bill, and suddenly decreased battery life.
• Download a mobile security app for your phone that scans every app you download. For extra protection, make sure your security app can also warn you when navigating to unsafe websites.
• Make sure to download firmware updates as soon as they are available for your device.

We’ll post updates as the story unfolds.