{"id":49341,"date":"2016-04-29T12:17:37","date_gmt":"2016-04-29T19:17:37","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=49341"},"modified":"2025-06-01T23:11:46","modified_gmt":"2025-06-02T06:11:46","slug":"fake-android-update-delivers-sms-click-fraud-europe","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/","title":{"rendered":"Fake Android Update Delivers SMS, Click Fraud in Europe"},"content":{"rendered":"<p>McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning of the year. Several users have complained in forums and social networks about a suspicious file with the name Android_Update_6.apk being automatically downloaded when a website is loaded.<br \/>\nRecently a user tweeted that one of the advertisers in a widely read German-language news website \u201cpushed\u201d this file when the user navigated the website:<\/p>\n<p style=\"text-align: center;\"><em>User reporting the download of the file Android_Update_6.apk.<\/em><br \/>\n<em> Source: https:\/\/twitter.com\/arminhausf\/<\/em><\/p>\n<p>A month ago, another user reported the same behavior but on a French daily newspaper website and the filename in French:<\/p>\n<p><em>User reporting the download of the file mise_\u00e0_jour_Android_6.apk on a French newspaper&#8217;s website.<\/em><br \/>\n<em> Source: <a href=\"https:\/\/twitter.com\/Baptouuuu\/status\/708391947937914880\">https:\/\/twitter.com\/Baptouuuu\/<\/a><\/em><\/p>\n<p style=\"text-align: left;\">On\u00a0January 29, another user reported the same incident but this time the report went to what appears to be the source of the download:<\/p>\n<p style=\"text-align: left;\"><em>User reporting the download of the file Android_Update_6.apk.<\/em><br \/>\n<em> Source: <a href=\"https:\/\/twitter.com\/Baptouuuu\/status\/708391947937914880\">https:\/\/twitter.com\/Baptouuuu\/status\/708391947937914880 <\/a><\/em><\/p>\n<p>Finally, in one of the earliest reports of this campaign, on January 7 another user reported on the website AndroidPolice the download of the suspicious file when visiting the mobile version from Russia:<\/p>\n<p style=\"text-align: center;\"><em>User reporting the download of the file Android_Update_6.apk on the website AndroidPolice.<\/em><br \/>\n<em> Source: https:\/\/github.com\/archon810\/androidpolice\/issues\/69 <\/em><\/p>\n<p>According to that report, the malicious ad loaded a URL pointing to an APK like the following, triggering the automatic download of the file by the default web browser:<\/p>\n<p style=\"text-align: center;\"><em>Android_Update_6.apk available on a remote server since April 20.<\/em><\/p>\n<p>The question that most users asked in forums when they received this suspicious file was: Is this APK file a legitimate Android update? The answer is absolutely not. Each manufacturer and carrier has its own method of delivering and installing Android updates but, so far, none of them has as a distribution method of an automatic download of an APK file when the user visits a random website. This behavior is most likely related to a malicious application, so we took\u00a0a deeper look at the app to find out its purpose and understand its\u00a0impact.<\/p>\n<p>Once the app is installed, the following icon appears in the home screen:<\/p>\n<p style=\"text-align: center;\"><em>The malware&#8217;s icon.<\/em><\/p>\n<p style=\"text-align: left;\">However, as soon as the user executes the app, the icon disappears, tricking the user into believing that the app is no longer on the system. Meanwhile, in the background, the malware sends encrypted data to a remote server in Estonia:<\/p>\n<p style=\"text-align: center;\"><em>Encrypted traffic sent to a remote server in Estonia.<\/em><\/p>\n<p>Some variants of the malware were packed and, even after we\u00a0unpacked of the payload, the code was very obfuscated. After some static and dynamic analysis we were able to learn that all the communication between the infected device and the control server is encrypted using an RSA asymmetric encryption algorithm:<\/p>\n<p style=\"text-align: center;\"><em>Malware generating a private key using an RSA specification.<\/em><\/p>\n<p>Here is the device information that was constantly sent by the malware to the remote control server:<\/p>\n<ul>\n<li>Device information: Android version, model, manufacturer, browser user-agent, device identifiers (IMEI, IMSI, android_id), locale (language\/country configuration), screen specifications, mobile network operator.<\/li>\n<li>Device status: Wi-Fi connectivity, root status, battery status.<\/li>\n<li>Malware settings: Version, apiKey, appId (package name), forGooglePlay.<\/li>\n<\/ul>\n<p>The most recent variant, from April 20, omits sending root status and instead\u00a0comes with the setting \u201cadvertId,\u201d suggesting that in future versions malware authors will include the advertisement identifier that distributed the specific variant to the infected device:<\/p>\n<p style=\"text-align: center;\"><em>The \u201cadvertId\u201d in the malware&#8217;s settings.<\/em><\/p>\n<p>In addition to that device information leak, which is normally used by malware authors to register infected devices, the malicious app silently intercepts all incoming SMS messages and forwards them encrypted to the same remote server in the following format:<\/p>\n<ul>\n<li>&#8220;type&#8221;: receive.sms<\/li>\n<li>&#8220;WiFi&#8221;: true\/false<\/li>\n<li>&#8220;text&#8221;: body of the message<\/li>\n<li>&#8220;phone&#8221;: origin of the message<\/li>\n<\/ul>\n<p>The amount of stolen SMS messages could generate a lot of noise in the backend, so the malware can also filter the intercepted messages using regular expressions obtained from the control server. Here\u2019s an extract of the regular expressions filtering the origin of the intercepted SMS:<\/p>\n<p style=\"text-align: center;\"><em>A list of intercepted SMS filters.<\/em><\/p>\n<p>Most of the names in the list belong to mobile phone companies in Russia, Germany, and France. Malware authors are interested in these messages because they are very useful for\u00a0performing SMS fraud by intercepting confirmation codes received by victims when cybercriminals subscribe users to premium services using SMS spoofing (by sending an SMS while pretending to be the victim). The filtered intercepted incoming SMS messages are sent back to the remote server using the following format:<\/p>\n<ul>\n<li>&#8220;type&#8221;: sms.filter<\/li>\n<li>&#8220;phone&#8221;: origin of the message<\/li>\n<li>\u00a0&#8220;text&#8221;: body of the message<\/li>\n<li>&#8220;phoneExp&#8221;: regular expression that matches the origin (for example, &#8220;*Orange.*&#8221;)<\/li>\n<li>&#8220;phonetext&#8221;: regular expression that matches the content (for example, &#8220;.*&#8221;)<\/li>\n<\/ul>\n<p>The malware is also able to report to the control server when the screen is on or off or if the user is present using the following types in the response:<\/p>\n<ul>\n<li>screen.on<\/li>\n<li>scree.off<\/li>\n<li>user.present<\/li>\n<\/ul>\n<p>If the cybercriminal knows that the user is not present (for example, screen off), the remote server can send the command \u201cwebClick\u201d:<\/p>\n<p style=\"text-align: center;\"><em>The webClick command.<\/em><\/p>\n<p>Judging by the name of the command, it is very likely this function is performing click fraud when the victim is absent. There is another command to execute JavaScript code:<\/p>\n<p style=\"text-align: center;\"><em>A command executing arbitrary JavaScript code.<\/em><\/p>\n<p style=\"text-align: left;\">One of the interesting flags sent to the remote server is \u201cforGooglePlay,\u201d which led us to investigate additional campaigns conducted in the past. We found that at the end of October 2015 malware authors were able to publish an early version of this malware using the developer \u201cSmart Development LLC,\u201d but apparently these apps were quickly removed. Currently they are available only in third-party markets such as apkpure:<\/p>\n<p style=\"text-align: center;\"><em>Trojanized apps published on Google Play on October 2015.<\/em><br \/>\n<em> Source: <a href=\"https:\/\/apkpure.com\/developer\/Smart%20Development%20LLC\">https:\/\/apkpure.com\/developer\/Smart%20Development%20LLC<\/a><\/em><\/p>\n<p>The first versions of this malware implemented only heavy obfuscation and encryption of the source code, but recent ones are packed to make static analysis difficult, encrypting the main payload to decrypt it and dynamically load it in runtime when the app is executed by the user. These efforts show that the malware is still in development. We have seen recent detections from users in France and Germany confirming that this malware campaign is currently active. McAfee has\u00a0notified the host of the control server and the Estonia CERT; we hope the control server will be taken down soon.<\/p>\n<p>To protect yourselves from this threat, employ security software on your mobile, and remember that Android updates are not delivered via APK files automatically downloaded when you visit a website. Further,\u00a0users should not trust applications downloaded from unknown sources.<\/p>\n<p>McAfee Mobile Security detects this Android threat as Android\/Dmisk and alerts mobile users if it is present, while protecting them from any data loss. For more information about McAfee Mobile Security, visit <a href=\"http:\/\/www.mcafeemobilesecurity.com\">http:\/\/www.mcafeemobilesecurity.com<\/a>.<\/p>\n<h2>SHA-256 hashes of the analyzed samples:<\/h2>\n<ul>\n<li>c60916b79e51182837f4833ae650b2abe2f7fce6eeb2f41f4ff248c6e1ec43a2<\/li>\n<li>40c30ab35455b8920d08989d2695f04178c8145e9929ed7dbcd95acc2507faa7<\/li>\n<li>5bfc6a02d594a8cc22bc4ed7b64e9986105a2a4992bd44cee18738182bafed60<\/li>\n<li>e9dfb3a432d9e54d344515ff000d94be48322f2d2c4f102a6a319768b7248c0b<\/li>\n<li>9c177189b981752c9cf89d5435c9d37c3b6441c02efb7d012426885747b7ac99<\/li>\n<li>705aeb71b7134d747853a3e65f0bf492d0af0dc2aab73f1a7ccc66e2a773fa84<\/li>\n<li>b44f7ae39cc6320a804174a5825d0f8fd74a6e519985f83397fe25bb12af99b1<\/li>\n<li>0d4ea10179d293666b637bbda385b7d9dd248dc998e5875ed2dddd0280fdff55<\/li>\n<li>95a3db31fc19a90f76a4a27ae87321b4d6b9b0122509258b5b87c1c5ee6f0e09<\/li>\n<li>d0f5ab874383a24fac7fcabb9fba2ffcbbafffb7dfe6dbb7b5224ecf7d443aa3<\/li>\n<li>3c9d303e375ee3125593035d4e861ee94b2340b9778c10a9b33871aaa4d727e5<\/li>\n<li>69d93b6e50d7d684af932691c65ab396f8ae6da4a4081a171eb233e3d8dabffd<\/li>\n<li>2a5fba694f60a249bf78d88c73223c60b6528c231b7579f59b8d57c67605cc8f<\/li>\n<li>1593900445f84ffc225fc1399a563644a31e0963aa70bd1317195970706a7942<\/li>\n<li>ab8abfe7420777eeb02b8d40c2f012dcea36737ffd616deb20d926cff727fdc0<\/li>\n<li>2b32a6c4aa09209ebe203cc305ca3c6970bd6025d4604a1b7458b1a0bc7f9bf7<\/li>\n<li>1980d5b3d8f1e30fdf0831fa2db059f1f1dd2dc749541ba3792e7093541e7958<\/li>\n<li>771946d95b38b8204562befd427fa45fd29fdfccb987bc0b33e796f4a1cbb5b0<\/li>\n<li>f2f2ebe7a709f0456a40dfba8eaf66af09fb2a9ed50845e1a5c24e8b78ddbb0c<\/li>\n<li>a9aef90cac11bc1f1635abde02be018a76ef4a876369d46349c5301c742597b3<\/li>\n<li>c0a6ec3f8850676c875eb9a151f33c319950f6a8260c469874e5a30fea0b6643<\/li>\n<li>d19ff00c8933e8fd23cfa1fb62615d18330fe43bc369492034f5755c69bf4f1c<\/li>\n<li>4ece7dc532ad074837d141c245177ad4ba38215a9dee8093970cd671f998d130<\/li>\n<li>29582ec3eb0fd77ed5a88d4dee68d5ad06299b014fa9d9f5acb35dd2282ae21e<\/li>\n<\/ul>\n<h2>URLs distributing malware APKs:<\/h2>\n<ul>\n<li>slidetracking[.]ru<\/li>\n<li>postway12[.]ru<\/li>\n<li>traffic2015[.]ru<\/li>\n<li>francia-apk[.]ru<\/li>\n<li>traff16[.]ru<\/li>\n<li>update-free-andr-6[.]ru<\/li>\n<li>6-androdid[.]ru<\/li>\n<li>freeupgrade6[.]ru<\/li>\n<\/ul>\n<h2>Control servers:<\/h2>\n<ul>\n<li>innotion[.]pw<\/li>\n<li>bugtracking[.]biz<\/li>\n<li>bugstracking[.]xyz<\/li>\n<li>alfabrong[.]eu<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning&#8230;<\/p>\n","protected":false},"author":462,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[37,180,4238,214],"coauthors":[1104],"class_list":["post-49341","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-android","tag-malware","tag-mcafee-mobile-security","tag-mobile-security1"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Fake Android Update Delivers SMS, Click Fraud in Europe | McAfee Blog<\/title>\n<meta name=\"description\" content=\"McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning of the year.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fake Android Update Delivers SMS, Click Fraud in Europe | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning of the year.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-04-29T19:17:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-02T06:11:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dmisk_Germany_Twitter-300x107.png\" \/>\n<meta name=\"author\" content=\"Carlos Castillo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@carlosacastillo\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Carlos Castillo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/\"},\"author\":{\"name\":\"Carlos Castillo\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe\"},\"headline\":\"Fake Android Update Delivers SMS, Click Fraud in Europe\",\"datePublished\":\"2016-04-29T19:17:37+00:00\",\"dateModified\":\"2025-06-02T06:11:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/\"},\"wordCount\":1573,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"keywords\":[\"android\",\"malware\",\"McAfee Mobile Security\",\"mobile security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/\",\"name\":\"Fake Android Update Delivers SMS, Click Fraud in Europe | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"datePublished\":\"2016-04-29T19:17:37+00:00\",\"dateModified\":\"2025-06-02T06:11:46+00:00\",\"description\":\"McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning of the year.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Fake Android Update Delivers SMS, Click Fraud in Europe\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe\",\"name\":\"Carlos Castillo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/729f5b9d2761341175762c5f10652607\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg\",\"caption\":\"Carlos Castillo\"},\"description\":\"Carlos Castillo specializes in the analysis of mobile threats and Android malware. Castillo performs static and dynamic analysis of suspicious applications to support McAfee\u2019s Mobile Security for Android product. He is the author of the McAfee-published white paper, \\\"Android Malware Past, Present, and Future,\u201d and wrote the \u201cHacking Android\\\" section of the book, \\\"Hacking Exposed 7: Network Security Secrets &amp; Solutions.\u201d As a recognized mobile malware researcher, Castillo has presented at several security industry events, including 8.8 Computer Security Conference and Segurinfo, a leading information security conference in South America. Prior to his position at McAfee, Castillo performed security compliance audits for the Superintendencia Financiera of Colombia, and worked at security startup Easy Solutions Inc., where he conducted penetration tests on web applications, helped shut down phishing and malicious websites, supported security and network appliances, performed functional software testing, and assisted in research and development related to anti-electronic fraud. Castillo joined the world of malware research when he won ESET Latin America\u2019s Best Antivirus Research contest with a paper titled, \u201cSexy View: The Beginning of Mobile Botnets.\u201d Castillo holds a degree in systems engineering from the Universidad Javeriana in Bogot\u00e1, Colombia.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/carlosacastillo\/\",\"https:\/\/x.com\/carlosacastillo\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/carlos-castillo\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Fake Android Update Delivers SMS, Click Fraud in Europe | McAfee Blog","description":"McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning of the year.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Fake Android Update Delivers SMS, Click Fraud in Europe | McAfee Blog","og_description":"McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning of the year.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-04-29T19:17:37+00:00","article_modified_time":"2025-06-02T06:11:46+00:00","og_image":[{"url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/Dmisk_Germany_Twitter-300x107.png","type":"","width":"","height":""}],"author":"Carlos Castillo","twitter_card":"summary_large_image","twitter_creator":"@carlosacastillo","twitter_site":"@McAfee","twitter_misc":{"Written by":"Carlos Castillo","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/"},"author":{"name":"Carlos Castillo","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe"},"headline":"Fake Android Update Delivers SMS, Click Fraud in Europe","datePublished":"2016-04-29T19:17:37+00:00","dateModified":"2025-06-02T06:11:46+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/"},"wordCount":1573,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"keywords":["android","malware","McAfee Mobile Security","mobile security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/","name":"Fake Android Update Delivers SMS, Click Fraud in Europe | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"datePublished":"2016-04-29T19:17:37+00:00","dateModified":"2025-06-02T06:11:46+00:00","description":"McAfee Mobile Research has been monitoring a mobile malware campaign targeting users in Germany, France, and Russia since the beginning of the year.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/fake-android-update-delivers-sms-click-fraud-europe\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Fake Android Update Delivers SMS, Click Fraud in Europe"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/894ee4a790607d505a13c24955d2edbe","name":"Carlos Castillo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/729f5b9d2761341175762c5f10652607","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Carlos-Castillo-96x96.jpg","caption":"Carlos Castillo"},"description":"Carlos Castillo specializes in the analysis of mobile threats and Android malware. Castillo performs static and dynamic analysis of suspicious applications to support McAfee\u2019s Mobile Security for Android product. He is the author of the McAfee-published white paper, \"Android Malware Past, Present, and Future,\u201d and wrote the \u201cHacking Android\" section of the book, \"Hacking Exposed 7: Network Security Secrets &amp; Solutions.\u201d As a recognized mobile malware researcher, Castillo has presented at several security industry events, including 8.8 Computer Security Conference and Segurinfo, a leading information security conference in South America. Prior to his position at McAfee, Castillo performed security compliance audits for the Superintendencia Financiera of Colombia, and worked at security startup Easy Solutions Inc., where he conducted penetration tests on web applications, helped shut down phishing and malicious websites, supported security and network appliances, performed functional software testing, and assisted in research and development related to anti-electronic fraud. Castillo joined the world of malware research when he won ESET Latin America\u2019s Best Antivirus Research contest with a paper titled, \u201cSexy View: The Beginning of Mobile Botnets.\u201d Castillo holds a degree in systems engineering from the Universidad Javeriana in Bogot\u00e1, Colombia.","sameAs":["https:\/\/www.linkedin.com\/in\/carlosacastillo\/","https:\/\/x.com\/carlosacastillo"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/carlos-castillo\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/462"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=49341"}],"version-history":[{"count":8,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49341\/revisions"}],"predecessor-version":[{"id":214766,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/49341\/revisions\/214766"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=49341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=49341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=49341"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=49341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}