Beware! This Android Trojan Stole Millions of Dollars from Over 10 Million Users

A newly discovered “aggressive” mobile campaign has infected
north of 10 million users from over 70 countries via seemingly
innocuous Android apps that subscribe the individuals to premium
services costing €36 (~$42) per month without their knowledge.

Zimperium zLabs dubbed the malicious trojan “GriftHorse.”
The money-making scheme is believed to have been under active
development starting from November 2020, with victims reported
across Australia, Brazil, Canada, China, France, Germany, India,
Russia, Saudi Arabia, Spain, the U.K., and the U.S.

No fewer than 200 trojan applications were used in the campaign,
making it one of the most widespread scams to have been uncovered
in 2021. What’s more, the malicious apps catered to a varied set of
categories ranging from Tools and Entertainment to Personalization,
Lifestyle, and Dating, effectively widening the scale of the
attacks. One of the apps, Handy Translator Pro, amassed as much as
500,000 downloads.

“While typical premium service scams take advantage of phishing
techniques, this specific global scam has hidden behind malicious
Android applications acting as Trojans, allowing it to take
advantage of user interactions for increased spread and infection,”
Zimperium researchers Aazim Yaswant and Nipun Gupta said^[1]
in a report shared with The Hacker News.

“These malicious Android applications appear harmless when
looking at the store description and requested permissions, but
this false sense of confidence changes when users get charged month
over month for the premium service they get subscribed to without
their knowledge and consent.”

Like other banking trojans, GriftHorse does not exploit flaws in
the Android operating system, but rather socially engineers users
into subscribing their phone numbers to premium SMS services upon
downloading the apps.

Following a successful infection, the victims are bombarded with
deceptive alerts promising a free “GIFT” that, when clicked,
redirect them to a geo-specific webpage to submit their phone
numbers for verification. “But in reality, they are submitting
their phone number to a premium SMS service that would start
charging their phone bill over €30 per month,” the researchers
said.

Following responsible disclosure to Google, the apps have been
purged from the Play Store. But they continue to be available on
untrusted third-party app repositories, once again underscoring the
risks associated with sideloading arbitrary applications and how
they can emerge as an intrusion route for malware.

“Overall, GriftHorse Android Trojan takes advantage of small
screens, local trust, and misinformation to trick users into
downloading and installing these Android Trojans, as well
frustration or curiosity when accepting the fake free prize spammed
into their notification screens,” Yaswant and Gupta concluded.