Last week, there was a significant increase in spam notifications that appeared to come from the Viber. The message informed the user that they had an audio message in their account.
As for the desktop and the version of the application for fixed computers, when the user selected the link in the fake message, they were transferred to the download page of the backdoor malware BKDR_KULUOZ.VLU.
However, users who opened the notification on their mobile devices were immediately redirected to other pages or search engines or even official app stores. Many mobile users were also taken to a streaming page, which secretly charged the credit card that the user had to enter during registration to confirm their details.
Viber spam with different behavior
The difference in destination is notable depending on the device's software. Thus, Android devices took the user to the “Go Launcher” application in the Google Play Store, while Apple devices took the user to a Chinese game in iTunes.
Many users were taken to pages that appeared empty, but a closer look at the page's code revealed that it contained links leading to other pages with adult content.
Great care is needed when the user opens an email message, even if it appears to come from the official service or application they are using. It is always preferable for security to type the URL directly into their browser and from the official website to determine if there is an issue with their account or if they have a message.
