Menu
This malware pretends to be WhatsApp, Uber and Google Play

This malware pretends to be WhatsApp, Uber and Google Play

The malware has spread through phishing campaigns over SMS

Hackers are stealing credit card information in Europe with malware that can spoof the user interfaces of Uber, WhatsApp and Google Play.

The malware, which has struck Android users in Denmark, Italy and Germany, has been spreading through a phishing campaign over SMS (short message service), security vendor FireEye said on Tuesday.

Once downloaded, the malware will create fake user interfaces on the phone as an “overlay” on top of real apps. These interfaces ask for credit card information and then send the entered data to the hacker.

This family of malware continues to evolve. Since February, FireEye has observed 55 malicious programs in Europe that use the same overlay technique.

Earlier versions targeted banking apps, but now the malware can spoof the interfaces to more popular software, including WhatsApp and Google Play.

Users tend to input credit card information into these products as well as into banking apps, FireEye researcher Wu Zhou said in an email.

"Threat actors usually want to gain the largest financial benefit. So they typically target these apps that have a large user base," he added.

In some cases, the malware has also targeted YouTube, Uber and Chinese messaging app WeChat.

To spread the malware, the hackers have sent off SMS messages with a link and tricked their victims into clicking on it. One SMS message said: “We could not deliver your order. Please check your shipping information here.”

Since February, FireEye has noticed that the malware has been spread through five different campaigns. In one campaign, the hackers managed to generate at least 130,000 clicks to the link where the malware was hosted.

Newer versions of the malware can also be difficult to detect. Only six out of 54 anti-virus tools tested noticed a danger with the malicious coding, according to FireEye.

The malware has been found contacting servers in the United Arab Emirates, Germany, Italy, Latvia and the Netherlands.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malware

Featured

Slideshows

Ingram Micro maintains Showcase 2018 momentum in Wellington

Ingram Micro maintains Showcase 2018 momentum in Wellington

Ingram Micro maintained Showcase 2018 momentum in Wellington, hosting more than 40 vendors at TSB Arena. Under the banner of Leading the Way, the event demonstrated what’s new, what’s next and how it can be used to improve business and everyday life.

Ingram Micro maintains Showcase 2018 momentum in Wellington
Ingram Micro launches Showcase 2018 in Christchurch

Ingram Micro launches Showcase 2018 in Christchurch

Ingram Micro kickstarted Showcase 2018 in Christchurch, hosting more than 40 vendors at Horncastle Arena. Under the banner of Leading the Way, the event demonstrated what’s new, what’s next and how it can be used to improve business and everyday life.

Ingram Micro launches Showcase 2018 in Christchurch
Data breach notification laws in NZ: How can partners prepare?

Data breach notification laws in NZ: How can partners prepare?

This exclusive Reseller News Roundtable outlined the responsibilities facing security partners today, assessing risk while evaluating the role of the vendor in providing added layers of protection.

Data breach notification laws in NZ: How can partners prepare?
Show Comments