SMS Stealer malware targeting Android users: Over 105,000 samples identified

Zimperium’s zLabs team has uncovered a new and widespread threat dubbed SMS Stealer. Detected during routine malware analysis, this malicious software has been found in over 105,000 samples, affecting more than 600 global brands. SMS Stealer’s extensive reach poses significant risks, including account takeovers and identity theft.

The SMS Stealer threat, first identified in 2022, uses fake ads and Telegram bots posing as legitimate services to trick victims into gaining access to their SMS messages. Once access is granted, the malware connects to one of its 13 Command and Control (C&C) servers, confirms its status, and transmits stolen SMS messages, including one-time passwords (OTPs).

OTPs are designed to add an extra layer of security to online accounts, particularly for enterprises controlling access to sensitive data. However, the SMS Stealer’s ability to intercept OTPs undermines this security feature, giving bad actors the means to gain control of victims’ accounts. The malware associated with SMS Stealer remains hidden, allowing for continuous attacks.

SMS Stealer impact

• Credential theft: The malware can intercept and steal OTPs and login credentials, leading to complete account takeovers.
• Malware infiltration: Attackers may use stolen credentials to infiltrate systems with additional malware. Increasing scope and severity of attack.
• Ransomware attacks: Stolen access can be leveraged to deploy ransomware, leading to data encryption and significant financial demands for data recovery.
• Financial loss: Attackers can make unauthorized charges, create fraudulent accounts, and facilitate significant financial theft and fraud.

“The SMS Stealer represents a significant evolution in mobile threats, highlighting the critical need for robust security measures and vigilant monitoring of application permissions,” said Nico Chiaraviglio, Chief Scientist at Zimperium. “As threat actors continue to innovate, the mobile security community must adapt and respond to these challenges to protect user identities and maintain the integrity of digital services.”