Selfmite Android malware returns, bigger & badder

Sending out more text messages and making more money for hackers

Mobile malware

The Selfmite worm that attacks Android phones and sends out text messages has made a reappearance, prompting security researchers to warn the new version is more dangerous and widespread this time.

According to IT security firm AdaptiveMobile, the worm first surfaced in June. This latest version, Selfmite.b, has infected many more users, uses several techniques to extract money from victims and is "difficult to stop".

Around 150,000 messages have been tracked as being sent by the worm over the last ten days in 16 countries a hundred times the number of messages generated by the previous version of the malware.

As in the previous version, Selfmite infects a user's phone if they click on a link in a text message reading "Hi buddy, try this, its amazing u know," and "Hey, try it, its very fine." Following the link download installs an APK file, which is a trojanised Google Plus app infected with the worm.

The worm then connects with a remote server and downloads a configuration file containing data that is used to spread the infection.

Whereas the previous version just spammed 20 contacts in a user's address book, this latest version sends a message to all contacts in a loop until the mobile operator detects a problem and blocks messages.

The worm uses multiple "touch points" to encourage the victim to do things that make money for the hacker.

Users are either directed to an application in Google Play after clicking on the installed worm icon, or they click on icons that Selfmite.b has placed on their desktops and are therefore redirected to unsolicited subscription websites. The worm also varies content according to IP addresses, meaning users in different countries will be redirected to different websites.

While iPhone users aren't at risk of infection, clicking on the link will redirect them to a fitness app in the Apple App Store.

"This is Selfmite returning on steroids," said Denis Maslennikov, security analyst at AdaptiveMobile.

"It's more aggressive self-propagating capabilities means more victims. In addition, it uses multiple links to engage with users, increasing its monetisation potential. This additional level of complexity makes Selfmite.b a real concern for both mobile carriers and users."

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
What is a Trojan?
Security

What is a Trojan?

27 Aug 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021