SMSFactory Android Trojan

Cybercriminals have set a widespread campaign in order to spread a new strain of mobile malware. The threat named SMSFactory is classified as an Android Trojan and is designed primarily to siphon money out from its victims. It does so by taking control over certain functionalities of the breached device and using them to send premium SMS and make phone calls to premium-rate numbers. SMSFactory has impacted Android users from all across the world with infected devices being identified in Russia, Argentina, Turkey, Brazil, Ukraine, Spain, France, and the U.S.

According to the cybersecurity researchers at Avast, the numbers dialed by Trojan are part of a conversion scheme while the SMS messages contain an account number designating the recipient of the money. The hackers could extract up to $7 per week from each infected device. It should also be noted that the developers of SMSFactory could be looking into expanding the malware's functionality as one of the identified versions was also able to access the victim's contact lists, likely as a way to find new targets.

SMSFactory is being spread via untrustworthy websites running malvertising campaigns, generating dubious push notifications, and displaying misleading alerts. Typically, these deceptive sites try to attract visitors by offering hacks for popular video games or software products, adult-oriented content, or free streaming services. The malicious payload is presented to users as an app possessing features aligned with the specific deceptive site. Once deployed on the victim's device, SMSFactory will hide its presence, leaving users wondering about the origin of the extra charges to their phone bills.