We've discovered a server that only attacks and/or spams smartphones and tablets — and not PCs.
A Swedish-based colleague of ours, Johan, was recently using his (Android) phone to search for boat trips in the Galapagos Islands. He found a site called Vagabond. And on Vagabond he found an entry with a link to: galacruises.com.
From a Windows-based browser, the link redirects to a site called islasgalapagos.travel.
But the results are much different if a mobile device is used…
Mobile browsers are redirected to a .info domain which in turn redirects yet again.
Sometimes it redirects to a popular game on Google Play:
But much of the time, it's NSFW sites (here seen from a Windows Phone):
And sometimes… malware! (As was the case for Johan.)
Here you can see that the malicious .APK file was blocked by one of our "online" detections.
Specific "disk" detection identifies the threat as a variant of FakeInstaller: Trojan:Android/FakeInst.AV.
While browsing Malaysiakini (a popular Malaysian website) on an Android phone, one of our analysts spotted this advertisement:
Clicking on the ad led to an external site displaying the following:
Looks reminiscent of the kind of text we've seen for years on webpages pushing rogues for Windows systems (and sometimes Mac).
Clicking on the "Download and Scan Now" button leads to an image, which looks like an antivirus app:
Clicking on the image brings you to a page that asks for your phone number and displays some interesting text:
"This is an ongoing subscription service until you quit. You will receive 4 sms per week and chargeable at RM4 per message. Only [REMOVED] user will receives max 3 sms per week and chargeable at RM4 per message. Data charges are billed separately by mobile operators."
So, it's an SMS subscription service. Provide a phone number, and the user gets an SMS message with registration instructions for the service.
Once registered, another SMS is sent providing a download link. When we tried the link, the only thing we got was a message saying "Sorry, you have exceeded the allowed download limit." The site's index page claims to be "under construction."
Fortunately, the SMS with the registration instructions also included instructions for stopping the service.
We normally recommend users read the permissions requested when downloading a mobile app. In this case, reading the text before downloading would also be prudent. This was probably not the service a user was looking for when they clicked on the ad.
Our Browsing Protection feature currently rates the site hosting the supposed APK download as Suspicious.
Updated to add:
Like Windows-based Rogueware, this "Android Antivirus" scam recognizes other operating systems — but fails to fine tune the bait.
According to his Twitter bio: he's a long-haired over-intoxicated geek from Sweden living in Finland, who likes shiny unixy things.
He's a senior software engineer/developer on our Mac Protection team (and a generally good guy).
If you're also a geek — Rasmus thinks it would be "neat" (that's a quote) if you'd give our "Safe Anywhere Mac Technology Preview" a try. The team is developing a new feature that they want to roll out in a few weeks time. So… if you have the skills to run beta software, Rasmus (and team) would really appreciate the feedback.