Users of smartphones running Google’s Android OS were warned Tuesday night (Manila time) against a new SMS malware disguised as a version of the new Firefox browser for Android.
GFI Labs said the app posing as the popular browser is hosted on some Russian websites, one of which had hosted a malware posed as an app of the 10th Anniversary Edition of Grand Theft Auto.
“The criminals are leveraging on Firefox for Android in relation to the official, non-beta release of the said Web browser on Google Play last June 26,” GFI said in a blog post.
It said its antivirus product detects the malicious apps as Trojan.AndroidOS.Boxer.d.
GFI said the latest version of the Boxer malware, once installed, loads a Rules page on the phone and asks users to accept it.
The app then sends a premium SMS message to the numbers 2855, 3855, 7151, or 8151. The Rules page discloses in small text that users will be billed for sending a premium SMS message.
“Boxer then directs users to the actual website where the legitimate app can be downloaded after claiming that it has successfully activated,” GFI said.
On the other hand, it said the newest variant is more devious since users will not see the Rules page or be prompted to confirm Boxer’s installation and activation.
Also, the malware loads google.com instead of directing users to the actual download site.
“One of our researchers believed that this is probably an effort to make users believe that they have installed a dud app, thus, allowing them to download and install the fake app again, which, in turn, allows Boxer to send the premium SMS message multiple times,” it said.
GFI noted another version of Boxer had posed as popular photo sharing app Instagram shortly after it launched on Google Play. — LBG, GMA News
Copied from here.
bump
OptimusLove said:
Users of smartphones running Google’s Android OS were warned Tuesday night (Manila time) against a new SMS malware disguised as a version of the new Firefox browser for Android.
GFI Labs said the app posing as the popular browser is hosted on some Russian websites, one of which had hosted a malware posed as an app of the 10th Anniversary Edition of Grand Theft Auto.
“The criminals are leveraging on Firefox for Android in relation to the official, non-beta release of the said Web browser on Google Play last June 26,” GFI said in a blog post.
It said its antivirus product detects the malicious apps as Trojan.AndroidOS.Boxer.d.
GFI said the latest version of the Boxer malware, once installed, loads a Rules page on the phone and asks users to accept it.
The app then sends a premium SMS message to the numbers 2855, 3855, 7151, or 8151. The Rules page discloses in small text that users will be billed for sending a premium SMS message.
“Boxer then directs users to the actual website where the legitimate app can be downloaded after claiming that it has successfully activated,” GFI said.
On the other hand, it said the newest variant is more devious since users will not see the Rules page or be prompted to confirm Boxer’s installation and activation.
Also, the malware loads google.com instead of directing users to the actual download site.
“One of our researchers believed that this is probably an effort to make users believe that they have installed a dud app, thus, allowing them to download and install the fake app again, which, in turn, allows Boxer to send the premium SMS message multiple times,” it said.
GFI noted another version of Boxer had posed as popular photo sharing app Instagram shortly after it launched on Google Play. — LBG, GMA News
Copied from here.
Click to expand...
Click to collapse
I may be assuming too much here but surely most android users only use play store or verified markets such as getjar or amazon and would not be careless enough to download from a dubious website?
Or they would google "android firefox" and follow the top results which are all official. So this would mainly affect people looking for warez?
Dave
( http://www.google.com/producer/editions/CAownKXmAQ/bigfatuniverse )
Sent from my LG P920 using Tapatalk 2
mistermentality said:
I may be assuming too much here but surely most android users only use play store or verified markets such as getjar or amazon and would not be careless enough to download from a dubious website?
Or they would google "android firefox" and follow the top results which are all official. So this would mainly affect people looking for warez?
Dave
( http://www.google.com/producer/editions/CAownKXmAQ/bigfatuniverse )
Sent from my LG P920 using Tapatalk 2
Click to expand...
Click to collapse
Not necessarily warez, Most people like to "sideload" apks to their phone via their lappytop.
Related
Reffering to an article published on a norwegian mobile site mobilen.no
Google Translation:
The operating system Android has previously been criticized for lack of security.
Now it turns out that the scammers for the first time have managed to flea the Android users money by spreading a known trojan - an application that may look innocent, but which in reality is a virus.
"Invisible" SMS-payment
The security company Kaspersky Lab to warn of the threat. The current Trojan called simply MOVIE PLAYER, but has not been available in the Android Market. Instead, users have downloaded the trojan via a variety of websites, which is easy because the user can install what they want on mobile.
When MOVIE PLAYER is installed on the mobile phone will send out expensive SMS is without users noticing it. Mobil.se report that Swedish Android users who have downloaded the Trojans want to call several Russian mobile numbers without country code, which fortunately only works in Russia. Still, warns David Jacoby in Kaspersky Lab that there is nothing that prevents Trojans to update itself and find local payment numbers in the new country.
According to Kaspersky Lab's MOVIE PLAYER the first Trojan that is specifically aimed at operating system Android. The same security company has previously warned that especially Android and Symbian will be the hackers future terrorist targets.
Google's Android operating system based on open source, which has received a number of skeptics to argue that it is not as safe as other OS. There are also stand-up for anyone to publish applications in the Android Market, the app store almost censor any content.
The advantage of such a system is that it aims to increase innovation in application development, and that there is a free and unfiltered market. The disadvantages include a large number of useless apps, not to mention that it is easier to spread viruses.
Yeah, why does and movie player need permission to send SMS? Call it SMS Spammer and its called after what it does. A trojan in my opinion would NOT request permission he just would send them, hide itself from taskmanager...
btw a movieplayer with 13kb
Dont download **** movie players that require permission to send SMS
edit: kaspersky for android is coming
Norton Antivirus for android, Apparently it supports Android 2.X
http://www.symantec.com/norton/smartphone-security-android
http://www.intomobile.com/2010/06/09/norton-anti-virus-released-for-android/
PhilDsT said:
Yeah, why does and movie player need permission to send SMS? Call it SMS Spammer and its called after what it does. A trojan in my opinion would NOT request permission he just would send them, hide itself from taskmanager...
btw a movieplayer with 13kb
Dont download **** movie players that require permission to send SMS
edit: kaspersky for android is coming
Click to expand...
Click to collapse
It may be common sense to you and I, but that doesn't mean everyone always pays attention.
As for the naming of the malware, I agree - it doesn't seem like a traditional trojan. Though to a layman it could appear to be one, as a "trojan" is just something masquerading as something else.
Mano1982 said:
Norton Antivirus for android, Apparently it supports Android 2.X
Click to expand...
Click to collapse
There are plenty of AV's on the market for android, Norton and many others
My mention of kaspersky because they discovered it
And for installing software: android is as safe as any other (desktop) Os, it depends on the user. If you install everything without thinking /looking once, the phone will end up as a spamming machine, battery empty, and a high bill...
Sent from my DeVillain using XDA App
Yeah... I wouldn't be surprised if this whole story was blown up by Anti-Virus companies.
PhilDsT said:
My mention of kaspersky because they discovered it
Click to expand...
Click to collapse
They're the first to goto the press with it actually
It was submitted by a user to both dr.Webb and kaspersky at the same time... dr.Webb actually reported back a definition for it then Kaspersky... Though in the press's eyes, which is now everyone else's vantage point -- the story is different
/!\ BE AWARE OF YOUR APP, DavinciDevelopers try to steal them and sell them on the market !!
Hello guys,
Be careful, if you post an apk of your free app here, somebody will try to take the apk, remove the signature, and upload it as a paid version on the market !
The proofs : (edited to add new stolen softwares)
Llamadroid
- http://forum.xda-developers.com/showthread.php?p=10113570#post10113570
- http://www.androlib.com/android.application.com-kebab-llamadroid-zzjjD.aspx
(removed today, on 5th january)
Typo clock
- http://forum.xda-developers.com/showthread.php?t=814054
- http://www.appbrain.com/app/beautiful-clock-widget-3d/com.semicuda.typoclock
Iron soldiers
- http://forum.xda-developers.com/showthread.php?t=862875
- http://www.appbrain.com/app/iron-soldiers/vuxia.ironSoldiers
(removed from market today, on 5th january, but still referenced)
Championship racing 2010
- http://www.vividgames.com/sub_game.php?id=42
- http://www.androlib.com/android.application.com-vividgames-championship_racing_2010-zzxwq.aspx
(removed today, on 5th january)
Liquid wallpaper
http://forum.xda-developers.com/showthread.php?t=878252
http://www.appbrain.com/app/liquid-physics/livewallpaper.liquid
Bluetooth Scanner
http://forum.xda-developers.com/showthread.php?t=900923
http://www.androidzoom.com/android_games/casual/bluetooth-scanner_pvqg.html
(New !! Now, we have proof that ALL his apps are stolen)
And even Gameloft best sellers (paid games) :
http://www.androlib.com/android.app...ndroid-gand-gloftspaw-heroofsparta-zjCDi.aspx
(removed from market today, on 5th january, but still referenced)
http://www.androlib.com/android.application.com-gameloft-android-gand-gloftavar-avatar-zjCEx.aspx
(removed from market today, on 5th january, but still referenced)
Minigore
http://minigore.blogspot.com/2009/07/what-minigore-is.html
http://www.appbrain.com/app/minigore-hd/com.ambushgames.minigore
http://www.androlib.com/android.application.com-ambushgames-minigore-zzjqD.aspx
Zuma's revenge
Original
http://www.zumasrevengegame.com/
http://store.steampowered.com/app/3620/
Scammers
http://www.appbrain.com/app/zumas-revenge-hd/com.popcap.zumas_revenge
http://www.appbrain.com/app/zumas-revenge/com.fox.game.zumasrevenge
How is it possible ?
Google does not check your apk signature when you upload a software.
Even if you signed yous apk with you key, somebody else can put this on his google account.
The signature can be deleted easily if needed.
He can change the title of your app, so nobody see it, but he can't change the apk name nor the icon.
Why do we post our apk here ?
To have testers, to correct bugs, to have a perfect look and feel before put it on the market.
Because on the market people are rude, we have only one chance, so we need to avoid bugs.
And when we put our app online, we want to choose if it's paid or free (with ads or not).
What is the problem ?
If DavinciDevelopers steal and upload your app, he will lock your pak name.
2 apps can't have the same name on the market.
You may have a name like com.myname.myapp.apk
Where "myname" is the same in every app you do.
If he take that, this is a major issue for you because you will be associated to him on every search (google.com, market...).
So, you will have to change your app name and maybe your company name....
Within 1 or 2 days, the market is parsed from androlib, androidzoom, appbrain... and it's done. Google.com will see those websites, and you are trapped.
You will have your buggy app on the market, some people will pay for that, the thief will have some money, and every users will have a bad opinion of your app.
Why DavinciDevelopers does this ?
To make benefit from your work.
Because he doesn't care you are working from a long time on your app.
Because he doesn't care if your work is ruined, he will find somebody else.
How can we be protected ?
Because 2 apps can't have the same name, you should put your app on the market first.
If your app is in development stage, you can upload it as "draft", so it will not be visible on the market, but the name will be locked.
Who is DavinciDevelopers ?
Somebody that have 83 apps on the market !
Almost all of them are themes.
If you look the package name you can see for example :
com.nd.android.pandatheme.p__3d_android_theme
at :
http://www.androlib.com/android.application.com-nd-android-pandatheme-p__3d_android_theme-qAmiz.aspx
google search : "pandatheme", first link :
http://home.pandaapp.com:888/
So he is not a developer. He makes themes with a free online tool and sell them... nice.
And for the real apps he uploaded (about 5), they all are stolen, coming from poland, germany, and other places.
Almost every of them comes from XDA dev forums.
ps : this message should be marked as sticky in every development section.
Wow, I can't believe this
It gets even better! Check this out:
http://www.androlib.com/android.app...ndroid-gand-gloftspaw-heroofsparta-zjCDi.aspx
http://www.androlib.com/android.application.com-gameloft-android-gand-gloftavar-avatar-zjCEx.aspx
He released the liquid physics live wallpaper I posted on here as well.
http://forum.xda-developers.com/showthread.php?t=878252
http://www.appbrain.com/app/liquid-physics/livewallpaper.liquid
Attacking GameLoft was a bad move for this/these guy(s).
They hit somewhere they shouldn't have I think.
Khoral said:
Attacking GameLoft was a bad move for this/these guy(s).
They hit somewhere they shouldn't have I think.
Click to expand...
Click to collapse
He has ripped off Popcap as well
http://www.appbrain.com/app/zumas-revenge-hd/com.popcap.zumas_revenge
And MiniGore
http://www.appbrain.com/app/minigore-hd/com.ambushgames.minigore
So STICKY!!!
It's really funny the website slogan:
http://davincidevelopers.weebly.com/
Innovation is everything. WTF
What do you thing, does it matter to left a comment like: app is stolen,... Seller steals apps from real developers or something else in market for "his" apks?
I wrote an email to appbrain and told them about this: maybe they can at least exclude this person from appbrain???
Has anyone emailed him to let him know that we all know?
Dirtbags
Sent from your mom's phone
kiltedthrower said:
Has anyone emailed him to let him know that we all know?
Click to expand...
Click to collapse
Like they would care... they just want to make some quick money from other's work.
The only way we can solve this if somehow we contact google to do something about it.
Since yesterday, he deleted some apps from his market.
I'm the developer of iron soldiers, I had been notified yesterday by another xda forum user that he stole my app.
I emailed him and within 3 or 4 hours he removed the app.
He answered me that he is so sorry, that he shares his key with other people and he didn't know... blabla.
Anyway, he has many stolen apps so he is hard to believe.
Now I see that thanaos2042 created a new thread (thanks ) and that google already referenced it :
If you google "davincideveloppers", this post is already in the first page !
Internet has a memory, and his name will not be forgotten.
they sell a lot of apps which is 80++ but they still using free website ....what a cheapskate...
Holy ****. Mods, please sticky this!!
I sincerely hope Google kicks their ass for this. I'm not familiar with the ToS but I hope they get hit with a lawsuit and instant refunds to say the least.
Stealing from Indie Developers is simply ****ed up. Wouldn't it be funny if a massive attack was launched against this asshole's website? (wink wink)
Chalup said:
Stealing from Indie Developers is simply ****ed up. Wouldn't it be funny if a massive attack was launched against this asshole's website? (wink wink)
Click to expand...
Click to collapse
No, it wouldn't. He/they are using a free web host so that would effectively be an attack on a whole lot of innocent sites.
Terrible to steal!
stolen apps are all over the market, ive even seen the r2d2 live wallpaper from the droid, on the market for 99p,
Good to know about these flagrant ripoffs
Looks like someone took their website down. The link now shows a page that isn't published.
Edit: Looks like Google could do something about this since it appears to be a violation of the terms of service (see 11.4, 13.3 and 16)
11. Content licence from you
11.1 You retain copyright and any other rights you already hold in Content which you submit, post or display on or through, the Services. By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive licence to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services. This licence is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services.
11.2 You agree that this licence includes a right for Google to make such Content available to other companies, organizations or individuals with whom Google has relationships for the provision of syndicated services, and to use such Content in connection with the provision of those services.
11.3 You understand that Google, in performing the required technical steps to provide the Services to our users, may (a) transmit or distribute your Content over various public networks and in various media; and (b) make such changes to your Content as are necessary to conform and adapt that Content to the technical requirements of connecting networks, devices, services or media. You agree that this licence shall permit Google to take these actions.
11.4 You confirm and warrant to Google that you have all the rights, power and authority necessary to grant the above licence.
13.3 Google may at any time, terminate its legal agreement with you if:
(A) you have breached any provision of the Terms (or have acted in manner which clearly shows that you do not intend to, or are unable to comply with the provisions of the Terms)
16. Copyright and trade mark policies
16.1 It is Google’s policy to respond to notices of alleged copyright infringement that comply with applicable international intellectual property law (including, in the United States, the Digital Millennium Copyright Act) and to terminating the accounts of repeat infringers. Details of Google’s policy can be found at http://www.google.com/dmca.html.
16.2 Google operates a trade mark complaints procedure in respect of Google’s advertising business, details of which can be found at http://www.google.com/tm_complaint.html.
[email protected]
to me
You are receiving this message to inform you of a critical issue affecting your Android Market account.
Hello,
We recently discovered applications on Android Market that were designed to harm devices. These malicious applications ("malware") have been removed from Android Market, and the corresponding developer accounts have been closed.
According to our records, you have downloaded one or more of these applications. This malware was designed to allow an unauthorized third-party to access your device without your knowledge. As far as we can determine, the only information obtained was device-specific (IMEI/IMSI, unique codes which are used to identify mobile devices, and the version of Android running on your device).
However, this malware could leave your device and personal information at risk, so we are pushing an Android Market security update to your device to remove this malware. You will soon be receiving a notification on your device that says "Android Market Security Tool March 2011" has been installed. You are not required to take any action from there, the update will automatically run. You may also receive notification(s) on your device that an application has been removed. Within 24 hours of receiving the update, you will receive a second email confirming its success.
To ensure this update is run quickly, please make sure that your device is turned on and has a strong network connection.
For more details, please visit the Android Market Help Center at
http://market.android.com/support/bin/answer.py?answer=1207928
Regards,
The Android Market Team
©2011 Google, Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043
Email preferences: You are receiving this email to notify you of a critical issue affecting your Android Market account.
It's legit. I read that Google was going to push an update to anyone's phone who they determined had downloaded the malware. You can find info about it on the web. I read it on Drudge yesterday.
Sent from my HTC Glacier using XDA App
Have not received that but just saw a report about it on the news...
Legit. It was on Engaget.com.
Sent from my HTC Glacier using XDA App
What really cracks me up is they never have told me what item I downloaded from the Market that has an exploit. It probably was that damn Kongergate app. I knew that damn bunny on those commercials had a sinister plot!!!!
I use Lookout as a good backup/security program that caught a malware that woke my phone about 2am to call a foreign country...
One of your ads just redirected me to a site that told me that my Samsung Galaxy tab 3 got infected by a virus!
I didn't even click on it, I think.
The message was in my native language (german)
Pls try to fix this!
Some users could fall victim too such scams.
I guess your possibilities might be limited but maybe you can talk to your ad delivery networks to ban such ads and use better techniques to prevent such ads from appearing on their networks. (other websites have these issues as well)
This definitely wasn't a nice experience.
Sometimes ad blockers have their advantages (blocks viruses/scam/phishing) so if you don't want to loose people and get no money for showing ads you should do something about this
Regards,
Djfe
Why on earth did you click on the adverts?
I'm fairly sure most users will be more suprised by the fact that there are still people who don't use an ad blocker, especially on a tech site.
XDA doesn't individually approve each ad. Those are generated by, ususally, Google Adsense, based on your own browsing history.
Not to mention, nobody here should ever fall for 'you Android device has a virus'. This is a website for developers by developers. The fact that Android can't be infected by a virus is common knowledge to everyone here. XDA users are too tech-savvy to be fooled by something that ridiculous.
Sent from my SM-N9005 using Tapatalk 2
Its not always good to use them
ShadowLea said:
Why on earth did you click on the adverts?
I'm fairly sure most users will be more suprised by the fact that there are still people who don't use an ad blocker, especially on a tech site.
XDA doesn't individually approve each ad. Those are generated by, ususally, Google Adsense, based on your own browsing history.
Not to mention, nobody here should ever fall for 'you Android device has a virus'. This is a website for developers by developers. The fact that Android can't be infected by a virus is common knowledge to everyone here. XDA users are too tech-savvy to be fooled by something that ridiculous.
Sent from my SM-N9005 using Tapatalk 2
Click to expand...
Click to collapse
upto some extend you are right but sometime you should allow some non-intrusive adds to get displayed. Well those people who are non rooted may face such problems. Well the websites like xda, facebook and countless more are working because of adds...i am not against the add blocker but its not always advised.
sachoosaini said:
upto some extend you are right but sometime you should allow some non-intrusive adds to get displayed. Well those people who are non rooted may face such problems. Well the websites like xda, facebook and countless more are working because of adds...i am not against the add blocker but its not always advised.
Click to expand...
Click to collapse
Most of us use Tapatalk or the XDA app when on our Android devices. Those don't show apps
I'm not rooted either. You don't need root to use Adblock Plus in Firefox, even on Android. It's just a plugin in the browser.
Most of us are more than willing to help XDA by paying (For instance for the XDA Forum app), but we refuse to have to deal with intrusive ads. (Ironic, since I'm in advertising.)
Facebook isn't working because of the ads. Facebook is working because they earn millions selling your data.
i won't go into details
ShadowLea said:
Most of us use Tapatalk or the XDA app when on our Android devices. Those don't show apps
I'm not rooted either. You don't need root to use Adblock Plus in Firefox, even on Android. It's just a plugin in the browser.
Most of us are more than willing to help XDA by paying (For instance for the XDA Forum app), but we refuse to have to deal with intrusive ads. (Ironic, since I'm in advertising.)
Facebook isn't working because of the ads. Facebook is working because they earn millions selling your data.
Click to expand...
Click to collapse
allow some advertisements. won't gonna debate what anybody i know what all websites to...:good:
Well If I have clicked on the adverts then that was accidentally
yes most users on here are technical, but some are also noobs trying to search for roms for their devices
Android can be infected by viruses but not without the users interaction (the play store is pretty safe so you would need to download apps from suspicious sites)
Android only cannot be infected by drive-by-downloads
and no website would be able to warn you about something like that
I know that xda cannot filter adverts, but Google adsense might be able to do that if you report malicious ads to them
I'm waiting for the last promised update for my device (Samsung Galaxy Tab 3 10.1 -> Kitkat)
then I will root it/switch to a custom rom
on my rooted smartphone I'm using an adblocker (that replaces the host file)
Firefox isn't really good, the performance is very bad and it is still very buggy on some unoptimized sites
else I would use it
Chrome works the best on my devices
FF might work better on high-end devices/current devices but I don't own one at the moment (my devices are from 2011 and 2013)
I discovered a massive mobile advertising fraud campaign that pushes fake virus warnings that trick novice Android users into installing questionable apps.
The advertiser uses JavaScript hosted on Amazon's CloudFront that uses various techniques to fingerprint the users web browser and if and Android device is discovered a fake media player or fake Captcha will pop up on the users mobile device to try and trick the user into accepting push notifications.
Once the push notifications are pushed to the mobile web browser the phone will start to vibrate and beep or in some cases play loud sirens or even spoken words along with fake virus warnings claiming the device is infected with multiple non-existent viruses that lead the user to the Google Play store to install questionable apps.
Many of the infected websites are geared towards a younger audience such as popular games and anime but also pirated software and movies and porn sites are also infected with this advertisers script.
The advertiser boasts that they are able to bypass adblockers and one of the infected websites "wallpaperaccess(.)com" has also been seen to download a malicious Android app disquised as an AdBlock app.
MD5 sum of AdBlock.apk 6f1fd359a382348b3307ed9d64eeebaa
The advertiser behind the browser fingerprinting script hosted on CloudFront is "AdMaven" out of Tel Aviv.
Near the bottom of the script and hidden using Base64 encoding using a custom alphabet hides the domain names of the websites that do the push notifications from anther company out of Tel Aviv called "moviesupdates(.)com"
In some of the AdMaven scripts I've examined is the name of another advertiser out of Tel Aviv called "Taboola" and their name is also obfuscated in the script using Base64 and the custom alphabet: abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/
Almost all the domains are registred to DynaDot and NameCheap.
*Edited to add that NameCheap has turned over a new leaf and is now actively removing reported content.
Here is just a very small sample of the hundreds of infected websites:
deportivo-la-coruna(.)com/page(.)php
mr2(.)com
acampante(.)com
10lance(.)com
russisk(.)org
www(.)e-jurnal(.)com
formodessa(.)com
hdwallsbox(.)com
brightways(.)org
tvshows4mobile(.)com
freehottip(.)com
www.dlmania(.)com
hdmp4mania1(.)net
streamcr7(.)com
123moviesfun(.)is
downace(.)com
watchmoviestream(.)me
customsdutyfree(.)com
allsp(.)ch
www(.)rarbgtorrent(.)com
cmacapps(.)com
speed-new(.)com
blogqpot(.)com
www(.)themetalup(.)com
cutewallpaper(.)org
o2tvseries(.)com
music(.)com(.)bd
manillenials(.)com
luchoedu(.)org
bosscast(.)net
kingdesi(.)com
www.legendofkorra(.)tv
deseneledublate(.)com
repack-games(.)com
amongushacks(.)com
wallpaperaccess(.)com
www.macappstores(.)com
softnspot.blogspot(.)com
btorrent(.)xyz
www(.)frkmusicx(.)com
www.()books-share(.)com
dbanimes(.)com
downloadpc-software.blogspot(.)com
apunkagameslinks.blogspot(.)com
naijatunez(.)com
freegogpcgames(.)com
venenosas(.)com(.)br
www.tumbral(.)com
www.twugi(.)com
gamemox(.)com
egyupgamer.blogspot(.)com
I have emailed AdMaven and Celebsupdates/Moviesupdates and several of the infected websites regarding this fraud but did not get any response.
I'm hoping a reputable security company or ad fraud company will expose this fraud further.
**UPDATE**
It appears the researchers at Bitdefender Labs are tracking the fake adBlock app as "Teabot and Flubot" but they seem unsure as to how the fake adblock app is being propagated.
I have tried to email Bitdefender to give them additional info regarding the malware and how its being spread through malvertising on the sites I listed above but Bitdefender's contact site is complete rubbish.
Bitdefender's article on the malware:
Bitdefender Labs
Daily source of cyber-threat information. Established 2001.
labs.bitdefender.com
Attached is a screenshot showing the malicious AdBlock.apk being advertised by the AdMaven script hosted on CloudFront:
One of the Android applications that people are frightened into downloading by the fake virus warnings is Psafe's DFNDR Antivirus/Cleaner.
Users have been tricked into installing DFNDR through fake virus warnings since 2013.
The developers claim that they do not condone these fraudulent ads and go so far as to ask users to send in screenshots of the fake virus warnings and the URL.
But this is just a ruse. It would be impossible to report on a single URL and the sites that push the fake virus warnings are created automatically.
The only way to truley stop the fake virus warnings is to go to the source of the fraudulent ads which is the AdMaven scripts hosted on Amazon's Cloudfront.
I have shared all this information with the representatives at Psafe about the fraudulent ads and how to stop it.
Psafe even requested I hold off on reporting of the fraud for 30 days which I granted but as you can see from these screenshots Android users are still being sent to the DFNDR app on the Google Play store through these scare tactics.
I have contacted Amazon to report the fraudulent ads and the drive-by downloads of the Android malware but they refuse to do anything about it.
Check the Play Store user reviews for yourself:
hxxps://play.google.com/store/apps/details?id=com.psafe.msuite&hl=en_US&gl=US
Security researcher Lukas Stefanko from ESET is now also tracking this mobile ad fraud and malicious AdBlock app.
Some URL shortener services distribute Android malware, including banking or SMS trojans | WeLiveSecurity
On iOS we have seen link shortener services pushing spam calendar files to victims’ devices.
www.welivesecurity.com
The link shortners being used in recent scareware campaigns are on Adf.ly
It is unfortunate that the true sources of all these fake virus warnings and mobile malware and calendar spam are not being revealed in this latest report.
No mention of the CloudFront scripts or the latest script that is pushing these scareware ads and malware:
hxxps://iclickcdn(.)com/tag.min.js which is being hosted on CloudFlare servers.
While searching for websites infected with the iclickcdn script I discovered that a federal government website frequented by members of congress had also been infected.
I notified the hostmaster and several other agencies and the script was purged from the site.
A link to URL scan that shows the heavily obfuscated iclickcdn JavaScript:
https://urlscan.io/responses/04a1722238c2eb4055efcf3123981dc1cfa9a48e49be8154e4f9d6d66a1e51a6/
sloshnmosh said:
The link shortners being used in recent scareware campaigns are on Adf.ly
Click to expand...
Click to collapse
Thanks for the interesting information.
I'd just like to inform you that Adf.ly is not welcomed and accepted already for years on this forum, and as soon as we recognise or get notified about such a link it gets removed immediately.
Remark: I've deleted the 5 duplicates of your post that suddenly popped up.
Regards
Oswald Boelcke
Oswald Boelcke said:
Thanks for the interesting information.
I'd just like to inform you that Adf.ly is not welcomed and accepted already for years on this forum, and as soon as we recognise or get notified about such a link it gets removed immediately.
Remark: I've deleted the 5 duplicates of your post that suddenly popped up.
Regards
Oswald Boelcke
Click to expand...
Click to collapse
Okay, thanks so much! I should have put cursors around the DOT of adfly so it wasn't a link.
Also, thank you so much for removing the duplicates, I was receiving errors so I was panicked when I saw I made multiple duplicate posts.