Phone scammers use COVID-19 vaccine appointments to try tricking victims into downloading malware

guest · Sep 23, 2021

Phone scammers use COVID-19 vaccine appointments to try tricking victims into downloading malware
September 23, 2021
https://www.cyberscoop.com/phone-sc...ry-tricking-victims-into-downloading-malware/

Hackers are targeting American and Canadian victims with a malware strain that used coronavirus-themed messages to dupe users into downloading software that collects their personal information, according to findings published Thursday.

The scammers, whose identities are unknown, rely on SMS text messages focused on fictional COVID-19 regulations and vaccine information to trick recipients into clicking a link. That link triggers a malicious software — dubbed TangleBot — that infects a user device to collect call data, microphone and camera access and can be combined with other hacking tools to gather financial data.
Click to expand...

The latest research from Cloudmark, a subsidiary of the email security firm Proofpoint, comes amid ongoing revelations about the ways that attackers have weaponized mobile technology to gather information about unwitting users.

While TangleBot appears to function as another tool that scammers use to separate victims from their money, the operators have differentiated themselves by using COVID-19 as a tool to tempt users into falling for the ruse.
Click to expand...

Cloudmark: TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures

Key Takeaways

A clever and complicated new SMS malware attack has been discovered in the United States and Canada.

This malware, coined TangleBot, can directly obtainpersonal information, control device interaction with apps and overlay screens, and steal account information from financial activities initiated on the device.

Click to expand...

Should a user fall victim and click on the link in the message, a website appears notifying the user that the Adobe Flash Player on the device is out of date and must be updated. If the user clicks on the subsequent dialog boxes, TangleBot malware is installed on the Android device.

TangleBot is then granted privileges to access and control many device functions (Figures 3 through 5), including contacts, SMS and phone capabilities, call logs, internet, camera and microphone, and GPS.
Mobile Users Should Be Aware
Mobile users should be alert and on the lookout for these unexpected SMS warning messages and follow these SMS best practices:
Click to expand...

guest · Oct 6, 2021

TangleBot Android malware hijacks phone to steal login credentials
October 5, 2021
https://www.hackread.com/tanglebot-android-malware-steal-login-credentials/

Now, there is another Android malware on the block called TangleBot, which employs more or less similar tactics to gain control of the device- the problem is that it is far more invasive than FluBot.
TangleBot Causing Trouble for Android Users
According to Cloudmark and Proofpoint cybersecurity researchers, both of which reported the new SMS-based (SMishing) malware campaign involving TangleBot, when TangleBot is installed on a device, it gains access to several different permissions to eavesdrop on user communications.

As soon as the link is clicked, malware operators get complete control of the device, from websites visited stealing login credentials and passwords since it uses a keylogger and spies on the user.
Hence, the malware is equipped with a full range of surveillance and data-stealing features.
Click to expand...

The Lure
According to Proofpoint researchers, the initial lure comes as an SMS message, and this message is masqueraded as information about COVID-19 vaccination regulations/appointment-related information.

More recently, researchers have noted a change in attackers’ strategy as there’s a new message that informs about fake local power outages that are due to occur.
Nevertheless, the aim behind both messages remains the same- to encourage potential victims to follow a link that supposedly offers detailed information.
Click to expand...

Proofpoint: Mobile Malware: TangleBot Untangled

Key Takeaways  

TangleBot is leveraging COVID-19 and electricity-themed lures in its effort to convince users to click on the malicious link and install the malware.

The SMS links are only malicious via Android mobile devices and are currently only being sent to US and Canadian users.

TangleBot, while sharing some similarities with the Medusa malware, has some key distinguishing features that make it particularly threatening, such as its advanced behaviors and transmission abilities and its use of a string decryption routine as part of its obfuscation. 

Click to expand...

Log in or Sign up

Phone scammers use COVID-19 vaccine appointments to try tricking victims into downloading malware

guest Guest

guest Guest

Log in or Sign up

Phone scammers use COVID-19 vaccine appointments to try tricking victims into downloading malware

guest Guest

guest Guest

Useful Searches