WAPDropper malware hooks you up to premium telecoms services

Hackers have incorporated machine learning into a strain that subscribes victims to legitimate services provided by telecoms firms

A newly discovered malware strain has been identified in the wild that unwittingly registers victims for premium services provided by legitimate telecoms firms. 

Named WAPDropper, the malware downloads and executes a payload, dropping a wireless application protocol (WAP) premium dialer which subscribes its victims to premium services in Thailand and Malaysia without their knowledge or consent.

The malware strain comprises two separate modules, according to Check Point Research, including a dropper module responsible for downloading the second-stage malware, and a premium dialer module that is responsible for the subscription element. 

This campaign identified by the researchers subscribes users to premium services offered by legitimate telecoms providers in Thailand and Malaysia.  

The scheme is centred on making calls to premium-rate numbers, which will, in turn, generate profit for the cyber criminals who collaborate with the owners of these particular phone numbers.

After the application is first installed on a device using third-party app stores, WAPDropper contacts the command and control server and receives the payloads to execute. This first payload is the premium dialer module, which opens a tiny web window and contacts premium services. 

Once WAPDropper opens the landing pages, it’ll attempt to subscribe the victim to these services. Alarmingly, the process includes a mechanism that can bypass the CAPTCHA security requirement, which must be overcome to complete a transaction. 

Related Resource

How cyber attack simulations differ from penetration tests and vulnerability scanning

Exploring the Cymulate Edge

It’s at this stage that the operators deploy the services of Super Eagle, a Chinese firm that offers a machine learning tool for image recognition. When the malware submits the verification code image to the service, the platform returns the coordinate position of the recognition result in the image, then parses the coordinate simulation landing.

The malware also attempts to avoid detection by hiding its icon to prevent users from spotting it on their device and uninstalling the app. The malware also performs checks to determine whether the victim is using a proxy or virtual private network (VPN). 

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

US, UK say Russia was behind SolarWinds hack
cyber attacks

US, UK say Russia was behind SolarWinds hack

16 Apr 2021
1Password targets enterprise customers with Secrets Automation
IT infrastructure

1Password targets enterprise customers with Secrets Automation

14 Apr 2021
PowerShell threats increased over 200% last year
cyber security

PowerShell threats increased over 200% last year

14 Apr 2021
Russia launched over a million cyber attacks in three months
hacking

Russia launched over a million cyber attacks in three months

13 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
University of Hertfordshire's entire IT system offline after cyber attack
cyber attacks

University of Hertfordshire's entire IT system offline after cyber attack

15 Apr 2021
NSA uncovers new "critical" flaws in Microsoft Exchange Server
servers

NSA uncovers new "critical" flaws in Microsoft Exchange Server

14 Apr 2021