Porn is malware's favorite disguise lately.
Zscaler has discovered two more cases of mobile ransomware that disguised themselves as porn apps and stole personal data from mobile devices.
The first app scares the user with a warning screen, accusing them of child pornography. The malware then steals the personal data in the background and sends it to a command and control (CnC) server. After installing the app on a device, the user will see a video player icon, which, when clicked, displays a fake Cyber Emergency Response website. The malware collects SMS messages, contacts, and email addresses.
The most interesting thing about the case is that the malicious app does not request administrator privileges to lock the device, so it is quite easy to remove. Zscaler did not find any code that actually locks the device.
In the second case, a Chinese SMS trojan is disguised as a porn app to steal sensitive data. Once installed, the malware tricks the victim into displaying random adult websites, steals sensitive information, and sends an SMS to predefined Chinese numbers in the background.
Using porn is a well-known tactic: 30% of Internet traffic is related to pornography in some way, giving malware creators an easy way to infect a large number of users.
During a recent data mining, Zscaler researchers noticed an increase in the volume of mobile malware that uses pornography (disguised as porn apps) to lure victims into various scams, stealing personal information , or even locking the device for ransom. Android Ransomware and an SMS trojan that use pornography to trick their victims are already in circulation, in addition to the two most recent apps that have been detected.
