[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 8 sources · 16 days · First seen · Last updated

Android mobile malware and phishing threats

Overview

Mobile users are facing evolving Android-based cyber threats, ranging from SMS phishing to specialized spyware.

Initial reports identified an SMS phishing campaign in Argentina where attackers impersonate telecommunications providers like Claro, Personal, and Movistar. These criminals use deceptive messages regarding loyalty program points to lure victims to fraudulent websites designed to steal credit card information. This campaign utilizes vulnerabilities involving fake base stations, or ‘SMS Blasters’, which force devices to downgrade from 5G to insecure 2G networks to bypass carrier fraud detection.

Subsequent developments show a shift toward more targeted malware, such as the ‘Corp MDM’ spyware. This campaign specifically targets the logistics sector by using fraudulent Google Play pages that impersonate established brands like CEVA and TKW Logistics. Once installed via malicious APK files, the spyware can intercept SMS messages, divert calls, and monitor notifications, posing a risk to professional communications and authentication processes.

Entities

Google · Movistar · Personal · Google Play · Android

Timeline

  1. 2 days ago

    [TECHNOLOGY] 4 sources
    Android spyware targets logistics firms and banking users

    New Android spyware campaigns, including Corp MDM targeting the logistics sector and RemControl targeting banking users, are utilizing fake Google Play pages and AI-assisted phishing to steal sensitive data.

  2. 18 days ago

    [TECHNOLOGY] 4 sources
    Cybercriminals use SMS phishing and 2G exploits to target mobile users

    Cybercriminals are using SMS phishing in Argentina to steal card data via fake loyalty programs, while Google plans Android 17 updates to block 2G-based SMS Blaster attacks.

Sources

20minutos.es · cybernoz.com · impactoinformativo.com.ar · malwarebytes.org · newsweek.ro · radiotvsierras.com · tecnologia.com.pt · tolhuinprimero.com