99 percent of Q1 mobile threats targeted Android

Over 99% of new mobile threats discovered by F-Secure Labs in the first quarter of 2014 targeted Android users, according to the company’s new Mobile Threat Report.

277 new threat families and variants were discovered, 275 of which targeted Android, one iPhone, and one Symbian. In comparison, the same quarter last year brought 149 new threat families and variants, 91% of which targeted Android.

The first quarter also saw a number of firsts for Android malware. This indicates the mobile threatscape is continuing to develop in sophistication and complexity.

The quarter saw the first cryptocurrency miner, which hijacks the device to mine for virtual currencies such as Litecoin. It saw the first bootkit, which affects the earliest stages of the device’s bootup routine and is extremely difficult to detect and remove. It saw the first Tor trojan and the first Windows banking trojan hopping over to Android.

“These developments give us signs to the direction of malware authors,” says Mikko Hypp?¶nen, Chief Research Officer at F-Secure. “We’ll very likely see more of these in the coming months. For example, mobile phones are getting more powerful, making it possible for cybercriminals to profit by using them to mine for cryptocurrencies.”

Great Britain experienced the highest level of mobile malware measured by F-Secure in Q1, with 15-20 malware files blocked per 10,000 users there, or about 1 in 500 users. The US, India and Germany all had 5 to 10 malware blocked for every 10,000 users. And in Saudi Arabia and the Netherlands, 2 to 5 malware were blocked per 10,000 users.

Devious intentions

What do mobile threats do once they’ve infected a device? The report finds that 83% of mobile trojans send SMS messages to premium numbers or SMS-based subscription services – by far the most common malicious activity.

Here’s a list of the most common malicious activities that mobile trojans engage in:

• Sending SMS messages to premium-rate numbers
• Downloading or installing unsolicited files or apps onto the device
• Silently tracking device location or audio or video to monitor the user
• Pretending to be a mobile AV solution but actually having no useful functionality
• Silently connecting to websites in order to inflate the site’s visit counters
• Silently monitoring and diverting banking-related SMS messages for fraud
• Stealing personal data like files, contacts, photos and other private details
• Charging a “fee” for use, update or installation of a legitimate and usually free app.