{"id":52626,"date":"2016-09-15T09:42:22","date_gmt":"2016-09-15T16:42:22","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=52626"},"modified":"2025-08-06T09:20:52","modified_gmt":"2025-08-06T16:20:52","slug":"calljam-malware-2016","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/calljam-malware-2016\/","title":{"rendered":"Why Cybercriminals Want to Rack Up Your Phone Bill: The CallJam Malware"},"content":{"rendered":"

 <\/p>\n

As smartphones get more sophisticated, it\u2019s easy to forget their humble origins. Through today\u2019s mobile apps, we can manage finances, order Ubers, and even do office work from the beach. But remember old-school flip-phones? They stood for one purpose \u2013 simply to make calls \u2013 and we all had them. Well, it turns out that basic function of dialing a number is as relevant as ever, especially for cybercriminals. In fact, they\u2019ve recently hijacked as many as half a million Android phones just to make calls, using the CallJam malware<\/a>.<\/p>\n

CallJam is unique among existing malware \u2013 applications that let crooks manipulate devices\u2019 behavior \u2013 because of its peculiar goal. After smartphones are infected, unlucky users will see their mobiles dial up mysterious numbers<\/a> from around the globe.<\/p>\n

Now, that seems strange at first, primarily because of motive. Why would criminals do this? They\u2019re not interested in deep and meaningful conversations. A person isn\u2019t even necessarily on the other end of the call, ruling out illicit persuasion as a motivator. Truth be told, the heart of the matter is likely telecommunications fraud.<\/p>\n

In the past, criminals have used a tactic that involved leased premium phone numbers<\/a> \u2013 the ones that charge an incredibly high price-per-minute \u2013 and profit-sharing. Essentially, perpetrators negotiate to receive a kickback from the number\u2019s owner in exchange for directing calls to it. There\u2019s a simple rationale that makes this lucrative. When costly calls are made, somebody has to pay for it. Large sums on the user\u2019s balance sheet can translate into more money padding up villains\u2019 coffers.<\/p>\n

While nobody has officially verified this as the motive for CallJam, this type of fraud has been on our radar for a while. The difference this time is that the rogues are pulling off this trick by infecting mobile phones, rather than landlines.<\/p>\n

The infection starts when a user unknowingly downloads a malicious app. Think about the last time you browsed Google Play, the official Android marketplace. There\u2019s a plethora of apps to draw your interest! Although Google has stringent safeguards to ensure their safety, clever criminals may sneak malicious programs among them. That\u2019s exactly what happened with CallJam<\/a>. It was disguised within the \u201cGems Chest for Clash Royale\u201d app. Uploaded in May, it has unfortunately been downloaded 100,000 to 500,000 times.<\/p>\n

After installation, the malware starts doing damage. CallJam actually contains a number of technically sophisticated commands, including sending web browsers to ad-serving websites<\/a>. However, for routing calls, there\u2019s no wizardry involved at all. In fact, you may not believe how basic the trick is: the app simply asks users for permission to use the phone.<\/p>\n

You see, when Android apps are installed, a pop-up window typically appears, asking for permission to access other device features. For example, messaging services may want to scan your contacts to let you chat with them, or ride-sharing services may need GPS to identify pick-up locations. Now, users can always deny these permissions. But in this case, many consumers must not have fully understood or read them. In the end, many people simply gave crooks permission to access their dial pad.<\/p>\n

Now, Google has already removed CallJam<\/a> from its marketplace and issued updates to combat this form of malware. That means it\u2019s no longer easily downloadable. However, this incident still contains key lessons for anyone with a smartphone in their pocket. As convenient as installing apps can be, let\u2019s not forget the dangers they can pose in the form of malicious code. And when it comes to villains trying to pull their scams, let\u2019s not overlook our phones\u2019 core function: making calls.<\/p>\n

Three tips to keep your smartphone safe:<\/h2>\n