A massive fraud campaign using 151 Android apps with 10.5 million downloads was used to enroll users into premium subscription services without their knowledge.
See also: Google Play Store: Developer verification is being strengthened to prevent scams
Avast researchers discovered the campaign, which they named “UltimaSMS,” and reported 80 related apps they found on the Google Play Store.
While Google quickly removed the apps, the scammers likely amassed millions of dollars in fraudulent subscription charges.
The malicious actors carried out the UltimateSMS campaign through 151 Android apps that pretended to be discount apps, games, custom keyboards, QR code scanners, video and photo editing programs, spam call blocking apps, camera filters, and more.
When you launch these apps, you use data from your smartphone, such as location and IMEI, to change their language to match your country.
Next, the app asks the user to enter their mobile number and email address to access the program's features.
Having the phone number and the required permissions, the app then registers the victim to an SMS service costing $40 per month, from which the scammers take a share as partners.
See also: Google: Hackers target YouTubers with cookie theft malware
analysis the victim the maximum possible amount based on their location.
Even though most of these apps do not provide the advertised functionality and despite the numerous negative reviews they had on the Play Store, their creators continue to find victims. Using such a large number of apps for the “UltimaSMS» campaign, the scammers maintained a continuous influx of victims and kept their presence on the Play Store, despite ongoing reports and removal actions by Google.
According to Sensor Tower, the countries that have been affected the most are Egypt, Saudi Arabia, Pakistan and the United Arab Emirates, with over one million victim users. In the US, the number of infected devices is 170,000.
What should those who have fallen victim to the scam do
Although uninstalling the Android app will prevent the creation of new subscriptions, it will not stop the new charge of the existing subscription. To avoid future charges, you need to contact your mobile carrier and request the cancellation of all SMS subscriptions.
You can view this list on GitHub that contains all the apps you need to remove immediately from your device.
See also: GitHub finds 7 code execution vulnerabilities in 'tar' and npm CLI
To avoid falling victim to this type of fraud, ask your mobile phone company to disable the premium SMS option for your account and avoid entering your phone number into applications that do not require this information.
It is also strongly recommended to read reviews before installing an app, and if there are repeatedly negative comments, avoid the app altogether.
