A scam that urges people to download an app if they want to buy a Coronavirus protection mask is targeting Android mobile users. Cybersecurity experts have discovered the app – SCAM which displays the following message: “Download the app by pressing the button below and install it. You will get a Coronavirus protection mask.”.
Victims who click on the download will then see another button that says: “Buy protective masks.” They are then taken to a fake site that supposedly provides masks for the Coronavirus, where they are presented with the following notification: “You have infected the site with a high dose of traffic.” While users are reading this message, hackers have already gained access to their Android phones and are stealing the users’ contacts from them. Once the hackers have obtained a user’s contacts, they will send them messages that will redirect them to the scam site.
The app – SCAM – was discovered by researchers at security firm Zscaler . So far, the scam appears to be stealing contacts , but Zscaler’s Shivang Desai warned that it could do much more. Specifically, he wrote in a company blogpost that the malware could ask the victim to pay online for the mask and steal their credit card information, but no such functionality has been found in the app so far . He also added that researchers speculate that the app is in its early stages and that such features will be added as the app is updated.
How to avoid fraud
If someone clicks to install the app, they will be given the opportunity to deny the app’s permissions to read contacts or send SMS messages before installation. However, to protect themselves, users should not download Android apps from anywhere other than the official Google Play Store, and they should not trust random and unknown sites that try to sell them supposedly durable medical equipment. If they are still concerned, they can download a high-quality anti-virus app from the Google Play Store to ensure they are more protected.
