Menu
This malware pretends to be WhatsApp, Uber and Google Play

This malware pretends to be WhatsApp, Uber and Google Play

The malware has spread through phishing campaigns over SMS

Hackers are stealing credit card information in Europe with malware that can spoof the user interfaces of Uber, WhatsApp and Google Play.

The malware, which has struck Android users in Denmark, Italy and Germany, has been spreading through a phishing campaign over SMS (short message service), security vendor FireEye said on Tuesday.

Once downloaded, the malware will create fake user interfaces on the phone as an “overlay” on top of real apps. These interfaces ask for credit card information and then send the entered data to the hacker.

This family of malware continues to evolve. Since February, FireEye has observed 55 malicious programs in Europe that use the same overlay technique.

Earlier versions targeted banking apps, but now the malware can spoof the interfaces to more popular software, including WhatsApp and Google Play.

Users tend to input credit card information into these products as well as into banking apps, FireEye researcher Wu Zhou said in an email.

"Threat actors usually want to gain the largest financial benefit. So they typically target these apps that have a large user base," he added.

In some cases, the malware has also targeted YouTube, Uber and Chinese messaging app WeChat.

To spread the malware, the hackers have sent off SMS messages with a link and tricked their victims into clicking on it. One SMS message said: “We could not deliver your order. Please check your shipping information here.”

Since February, FireEye has noticed that the malware has been spread through five different campaigns. In one campaign, the hackers managed to generate at least 130,000 clicks to the link where the malware was hosted.

Newer versions of the malware can also be difficult to detect. Only six out of 54 anti-virus tools tested noticed a danger with the malicious coding, according to FireEye.

The malware has been found contacting servers in the United Arab Emirates, Germany, Italy, Latvia and the Netherlands.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags malware

Featured

Slideshows

​Reseller News Connect – Securing your future as an MSP

​Reseller News Connect – Securing your future as an MSP

This Reseller News Connect event uncovered the threat landscape in a Kiwi context, highlighting how MSPs can securely manage IT environments, while implementing business continuity solutions to avoid unexpected disasters.

​Reseller News Connect – Securing your future as an MSP
StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Show Comments