SMS fraud becomes international
Cybercriminals are constantly looking for possible ways to make quick money on careless users. New schemes of SMS-fraud are constantly appearing on the Internet, since this way of earning allows attackers to quickly get rich. The new trend of the criminal industry has become monetization due to the popularity of electronic libraries.
Due to the widespread use of various devices for reading electronic books, the number of requests for searching online libraries is growing rapidly. And it’s already no news for anyone that any surge in online activity is attracting the attention of cybercriminals. Now attackers have begun to actively create resources for the distribution of electronic or audio books that users download as a self-extracting archive.
')
In fact, this is no self-extracting archive, but an executable file developed in the Delphi environment and protected by ASprotect version 2.x. Some of these installers install an unpleasant Win32 / Adware.FearAds ad module into the system that can integrate with two types of browsers - Microsoft Internet Explorer and Mozilla Firefox. It periodically shows pop-up banners, depending on the context of the visited resources, and can replace search results in popular search engines. The most annoying thing is that this ad module does not allow itself to be removed by the standard uninstall procedure, while showing a funny message:
After the download and launch of the archive, the user is warned that the content on this resource is paid, and for unarchiving you must enter the activation code, which can be received by sending an SMS to a short number.
It is curious that now attackers suggest choosing a country to send an SMS message. It is also interesting that in the list of countries I present not only the CIS, but also Germany, Israel and others.
This suggests that although the activity of SMS frauds is clearly slowing down in our country, the attackers are trying to apply already run-in schemes in other countries. And the example of electronic books is indicative, but it is far from the only one. For example, we have already met popular television series, which criminals distributed according to the same scheme.
Due to the widespread use of various devices for reading electronic books, the number of requests for searching online libraries is growing rapidly. And it’s already no news for anyone that any surge in online activity is attracting the attention of cybercriminals. Now attackers have begun to actively create resources for the distribution of electronic or audio books that users download as a self-extracting archive.
')
In fact, this is no self-extracting archive, but an executable file developed in the Delphi environment and protected by ASprotect version 2.x. Some of these installers install an unpleasant Win32 / Adware.FearAds ad module into the system that can integrate with two types of browsers - Microsoft Internet Explorer and Mozilla Firefox. It periodically shows pop-up banners, depending on the context of the visited resources, and can replace search results in popular search engines. The most annoying thing is that this ad module does not allow itself to be removed by the standard uninstall procedure, while showing a funny message:
After the download and launch of the archive, the user is warned that the content on this resource is paid, and for unarchiving you must enter the activation code, which can be received by sending an SMS to a short number.
It is curious that now attackers suggest choosing a country to send an SMS message. It is also interesting that in the list of countries I present not only the CIS, but also Germany, Israel and others.
This suggests that although the activity of SMS frauds is clearly slowing down in our country, the attackers are trying to apply already run-in schemes in other countries. And the example of electronic books is indicative, but it is far from the only one. For example, we have already met popular television series, which criminals distributed according to the same scheme.
Source: https://habr.com/ru/post/92747/
All Articles