Malware Distributors Abuse URL Shortener Services to Spread Dangerous Apps

guest · Jul 21, 2021

Malware Distributors Abuse URL Shortener Services to Spread Dangerous Apps
July 21, 2021
https://www.technadu.com/malware-di...rtener-services-spread-dangerous-apps/290747/

URL shortener services are being increasingly abused by malware distributors who exploit the lack of policy enforcement.

Users are typically tricked into downloading risky apps through the serving of “scareware” ads.

The apps request the granting of extremely risky permissions, and in tens of thousands of cases per year, they get approval.

Click to expand...

URL shortener services are always a gamble as you can never be sure about what comes out of the machine if you don’t actually test it.
The latest ESET report from malware analyst Lucas Stefanko dives deeper into the problem, presenting some of the most active real-world examples right now.

The problems start with the delivery of “scareware” ads to the person who clicked on the shortened URL, informing them that their mobile devices have been infected with malware. To respond to the risk, the users are urged to download an app from the Google Play Store or the Apple App Store (depending on the platform).
In the following video, Stefanko demos an example of a URL shortener service message which urges the user to download another APK file from a source outside the Play Store.
Click to expand...

ESET recorded 150,000 instances of Android malware downloads happening through abused URL shortener platforms. This tells us that the scale of the problem is already pretty big, and some regulation needs to be enforced immediately.
Click to expand...

ESET: Some URL shortener services distribute Android malware, including banking or SMS trojans

We’ve even seen link shortener services pushing “calendar” files to iOS devices and distributing Android malware – indeed, we discovered one piece of malware we named Android/FakeAdBlocker, which downloads and executes additional payloads (such as banking trojans, SMS trojans, and aggressive adware) received from its C&C server.

Below we describe the iOS calendar-event-creating downloads and how to recover from them, before spending most of the blogpost on a detailed analysis of the distribution of Android/FakeAdBlocker and, based on our telemetry, its alarming number of detections.
Click to expand...

Log in or Sign up

Malware Distributors Abuse URL Shortener Services to Spread Dangerous Apps

guest Guest

Log in or Sign up

Malware Distributors Abuse URL Shortener Services to Spread Dangerous Apps

guest Guest

Useful Searches