Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    August 2015
    S M T W T F S
    « Jul    
  • Email Subscription

  • About Us

    Author Archive - Karla Agregado (Fraud Analyst)

    Malicious schemes promising free or discounted items are effective because everyone likes a great offer. More so, if the offered item is a much-talked about product like Windows 8.

    Last year, we unraveled some fake Windows 8 generators, fake Windows 8 antivirus programs, and phishing email that surfaced right after the platform’s release. Though it’s been months since it was launched, we found out that certain bad guys are continuously using the brand to lure users into their ruse. This time, however, they are offering Windows 8 “activators” amidst news of Microsoft’s limited offer of discounted Windows 8 upgrade.

    During our research, we found several websites using Windows 8 as keywords. The first site purportedly offers free Windows 8 “activator”, which is actually fake (detected by Trend Micro as HKTL_KEYGEN).


    Figure 1. Screenshot of site offering fake Windows 8 activator

    The other site we looked into also offers free Windows 8 activator, dubbing it the “Windows 8 Activator Loader Extreme Edition 2013”.

    Read the rest of this entry »


    The much-anticipated 2012 London Olympics is set to kick off this Friday.

    As the event draws nearer, we expect to see online attacks riding on different Olympics-related activities. Sure enough, we saw this interesting Facebook wall post regarding the said event:

    The site, hosted on the domain liveolympictickets(dot)com, appears to offer tickets for sale. Moreover, the site uses the colors and look and feel of the official site:

    Exploring the site, I found that clicking on the blue tab Olympic Tickets – Buy Tickets for the London 2012 Olympics leads to other pages within the site that mimics normal online transaction pages, such as details about the items to be purchased. In this case, if the user proceeds with the transaction, he/she can choose which games to watch:

    However, towards the end, the user is asked for their personal details:

    After this, the site asks the user to continue with the payment by entering credit card details or choosing another payment method:

    The final page shows that the user’s order has been “confirmed.”

    We checked the official website of the London Olympics, where it was possible to check if the ticket vendor was legitimate. However, the site was not recognized and therefore unauthorized to sell tickets. The rest of our investigation shows that it is indeed a phishing page set up to capture user information.

    Additionally, we also saw a lot of newly created domains related to this event that included keywords like “2012 london summer games,” “2012 olympic ticket,” “britain olympics 2012,” “olympic 2012 ticket” and other variations thereof.

    We already block all malicious URLs involved via the Web Reputation Service; therefore Trend Micro customers are now protected via Trend Micro Smart Protection Network.

    For complete information on the latest Olympic-themed threats—including quizzes and safety guides, you can visit Race to Security, the Trend Micro security guide to major sporting events such as the Olympics, by clicking the banner below:

    Related posts:

    Posted in Bad Sites, Social | Comments Off on Bogus London Olympics 2012 Ticket Site Spotted

    Following the fake versions of Instagram, Angry Birds Space, and Farm Frenzy apps, we recently spotted a website offering different fake Skype mobile apps for Android. But based on our analysis, these apps are actually malware that run on older Symbian versions or Android devices installed with apps that enable execution of Java MIDlet. Once installed, the malware send messages to premium numbers without users’ consent.

    The website http://{BLOCKED} offers different versions of Skype app for Android. The said site is hosted on Russian domains, similar to the webpages we’ve seen hosting the fake Instagram and Angry Birds Space apps. During analysis, we attempted to download the said app, but noticed that the said app was being downloaded from another website, http://{BLOCKED}

    We also tried downloading the other Skype mobile app versions being offered by the site. Doing so, however, only lead us to the same .JAR file (instead of an .APK file, the expected download file for Android apps) downloaded from the same malicious site. This .JAR file (detected by Trend Micro as JAVA_SMSSEND.AB) is a Java MIDlet that poses as an installer of Skype for the Android platform. Once executed, the file displays the following interface:

    Should users press the left soft key of their smartphone, it displays the following:

    However, pressing the right soft key redirects the mobile device’s browser to the URL http://{BLOCKED} This malicious app functions to send SMS messages to specific numbers. As a result, affected users incur unnecessary monetary charges for these messages.

    Though these fake Skype apps are marketed specifically to Android users, this malicious .JAR file executes on pre-SIS (Software Installation Script) Symbian phones or certain versions of Android that run Java MIDlet. For Android devices to run Java MIDlet, users must first install an app that enables the device to execute the said file. Typically, these type of apps are available on third-party app stores.

    To have an an overview of the latest threats targeting Android devices, you may refer to our infographic Behind the Android Menace: Malicious Apps.

    Trend Micro protects users from this threat via Smart Protection Network™ , which detects and deletes this malicious .JAR file. Access to related websites is also blocked via web reputation service. As an added precaution, users must refrain from downloading apps from dubious websites. Users should also make it a habit to read mobile apps ratings and reviews, to know which apps are safe to download.

    To know more about how to enjoy your mobille devices safely and securely, you may refer to our comprehensive Digital Life e-guides below:

    With additional analysis from Christopher So.

    Posted in Malware, Mobile | Comments Off on Fake Skype for Android Leads to Malicious .JAR File

    Last month, we have seen cybercriminals use the popularity of apps like Instagram and Angry Birds Space to deliver malware on Android phones. This time, we spotted the same social engineering tactic using Adobe‘s name.

    This webpage is also found to be hosted on Russian domains, similar to the fake Instagram and Angry Birds Space apps that we previously reported. To further entice users into downloading the fake Adobe Flash Player app, the text on the webpage claims that it is fully compatible with any Android OS version:

    When users opt to download and install the said fake app, the site connects to another URL to download malicious .APK file, which Trend Micro detects as ANDROIDOS_BOXER.A. ANDROIDOS_BOXER.A is a premium service abuser, which means it sends messages to premium numbers without the user’s permission, thus leading to unwanted charges. This type of Android malware is just one of the types we were able to identify in our infographic, A Snapshot of Android Threats.

    Upon further investigation, we have seen a bunch of URLs that are hosted on the same IP as this particular website. Based on the naming alone used in these URLs, it appears that Android is a favorite target for cybercriminals behind this scheme.

    Trend Micro protects your Android phones from accessing these malicious sites and from downloading malicious .APK files on your phones via the Mobile Security Personal Edition app. Apart from blocking access to malicious sites, our app scans each app you install to ensure your safety.

    For your reference, Adobe Flash Player from Adobe Systems can be downloaded via the Google Play store.

    Posted in Bad Sites, Malware, Mobile | Comments Off on Malware Masquerades as Flash Player for Android

    Recently, Facebook announced its acquisition of Instagram— a popular photo-sharing smartphone app, which also released an Android version almost a week ago. It was reported that Facebook paid approximately $1 billion (£629m) in cash and stock for the said takeover.

    Cybercriminals, soon enough, started to take advantage of Instagram‘s popularity. We discovered a spoofed webpage containing a rogue version of Instagram. The said webpage mimics Instagram‘s legitimate download page. The red squares indicate clickable links that lead to the download:

    For your reference, below is a screenshot of the site hosting the legitimate app:

    My colleague Jonathan Beltran also uncovered a rogue version of Angry Birds Space. Similar to the fake Instagram app, the webpage hosting this rogue app is hosted on a Russian site.

    Both the rogue Instagram and Angry Birds Space are detected as ANDROIDOS_SMSBOXER.A. Based on our initial analysis, the malware will ask users to permit the sending of a query using short numbers to supposedly activate the app. In reality, this malware sends a message to specific numbers. The rogue app also connects to specific sites, to possibly download other files onto the device.

    For the past few days, we have been seeing several other Russian domains hosting fake webpages posing as download pages for some popular Android apps. Some of the apps used in this scheme include Fruit Ninja, Temple Run and Talking Tom Cat. Users are advised to remain cautious before downloading Android apps, specially those hosted on third-party app stores. To know more on how to prevent downloading malicious apps and other safety tips, you may read the following e-guides:

    Trend Micro™ Smart Protection Network™ prevents access to the malicious website so users are protected from clicking and downloading the fake Instagram and Angry Birds Space app. Furthermore, Trend Micro Mobile Security detects the .APK to protect Android smartphones from the malware’s malicious routines.



    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice