{"id":4601,"date":"2014-04-23T14:30:15","date_gmt":"2014-04-23T18:30:15","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=4601"},"modified":"2020-02-26T10:49:47","modified_gmt":"2020-02-26T15:49:47","slug":"fakeinst-targets-us-users","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/fakeinst-targets-us-users\/4601\/","title":{"rendered":"First Ever Android SMS Trojan Targeting U.S. Users"},"content":{"rendered":"<p>As Google\u2019s mobile platform continues to grow in popularity, so too does the tendency among cybercriminals toward developing malware that targets it. Interestingly, though, until very recently (as in the last day or so), our researcher friends at Kaspersky Lab had never seen an Android SMS Trojan targeting users in the United States. That \u2013 of course \u2013 has now changed with the emergence of an Android Trojan known as \u2018Trojan-SMS.AndroidOS.FakeInst.ef\u2019 (FakeInst).<\/p>\n<p>Oddly enough, in an email interview, Kaspersky Lab Expert Roman Unuchek explained that he has never really understood why SMS Trojans failed to take off in the U.S.<\/p>\n<p>As if its status as the premiere SMS Trojan targeting Android users in the U.S. wasn\u2019t enough, FakeInst is also targeting Android users in an additional 65 countries. As Unuchek notes, this is <a href=\"http:\/\/www.securelist.com\/en\/blog\/8209\/An_SMS_Trojan_with_global_ambitions\" target=\"_blank\" rel=\"noopener nofollow\"><span style=\"color: #0000ff\"><span style=\"text-decoration: underline\">a mobile threat with global ambitions<\/span><\/span><\/a>. In fact, FakeInst is known to have targeted users in Germany, France, Finland, Hong Kong, Ukraine, the U.K., Switzerland, Argentina, Spain, Poland, Canada, China, and many more nations.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2014\/04\/06043715\/FakeInst-Android-Trojan.png\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-4603\" alt=\"FakeInst Android Trojan\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2014\/04\/06043715\/FakeInst-Android-Trojan.png\" width=\"972\" height=\"521\"><\/a><\/p>\n<p>FakeInst is <a href=\"https:\/\/www.kaspersky.com\/blog\/number-of-the-week-10-million-malicious-android-apps\/\" target=\"_blank\" rel=\"noopener nofollow\"><span style=\"color: #0000ff\"><span style=\"text-decoration: underline\">a malicious Android application<\/span><\/span><\/a> whose purported use is to watch pornographic films. After a user downloads, installs, and opens the app, it then prompts that person to send a text message in order to purchase paid content from the app. Thanks to an extensive database, Fakeinst is able to send premium rate messages in 66 countries.<\/p><blockquote class=\"twitter-pullquote\"><p>Inside Fakeinst, the first ever #Android Trojan which is able to steal from U.S. users by sending premium SMS. #Security<\/p><a href=\"https:\/\/twitter.com\/share?url=https%3A%2F%2Fkas.pr%2FMLS8&amp;text=Inside+Fakeinst%2C+the+first+ever+%23Android+Trojan+which+is+able+to+steal+from+U.S.+users+by+sending+premium+SMS.+%23Security\" class=\"btn btn-twhite\" data-lang=\"en\" data-count=\"0\" target=\"_blank\" rel=\"noopener nofollow\">Tweet<\/a><\/blockquote>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2014\/04\/06043714\/FakeInst-Screengrab.png\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-4604\" alt=\"FakeInst Screengrab\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2014\/04\/06043714\/FakeInst-Screengrab.png\" width=\"338\" height=\"600\"><\/a><\/p>\n<p>When and if the user sends that text message, the Trojan will open an adult website \u2013 however, it\u2019s a free site, which may be accessed directly and without any payments.<\/p>\n<p>In the case of the United States, the Trojan will only send premium rate SMS messages to numbers that fall within the country\u2019s mobile country code. FakeInst then sends three messages to the premium number \u2013 each message costing $1.99.<\/p>\n<div class=\"pullquote\">\u201cAs if its status as the premiere SMS Trojan targeting Android users in the U.S. wasn\u2019t enough, FakeInst is also targeting Android users in an additional 65 countries\u201d<\/div>\n<p>Perhaps even more seriously, the malicious application can also intercept, delete, and even respond to incoming text messages.<\/p>\n<p>Unuchek believes the FakeInst was likely developed by cybercriminals in Russia.<\/p>\n<p>As stated above, threats targeting the Android platform are increasingly commonplace, which comes as no surprise considering the open nature of the platform and its enormous popularity. Last year, <a href=\"https:\/\/www.kaspersky.com\/blog\/an-android-that-robbed-your-bank-account\/\" target=\"_blank\" rel=\"noopener nofollow\"><span style=\"color: #0000ff\"><span style=\"text-decoration: underline\">Android malware designed to steal from bank accounts<\/span><\/span><\/a> was somewhat novel. Now <a href=\"https:\/\/www.kaspersky.com\/blog\/faketoken-2014q1\/\" target=\"_blank\" rel=\"noopener nofollow\"><span style=\"color: #0000ff\"><span style=\"text-decoration: underline\">Android banking malware is increasing dramatically<\/span><\/span><\/a>. If Android SMS Trojans targeting users in the U.S. follows the trend set by Android banking Trojans, then you should expect to see some more of these sorts of threats moving forward.<\/p>\n<p>To avoid such threats and associated money loss, only install software from well-established marketplaces like Google Play and Amazon App Store, disable the (in)security option \u201cAllow installation from unknown sources\u201d and use <a href=\"http:\/\/kas.pr\/kmsf\" target=\"_blank\" rel=\"noopener\"><span style=\"color: #0000ff\"><span style=\"text-decoration: underline\">dedicated mobile security solution<\/span><\/span><\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Malware targeting Android devices is increasing, and for the first time, an active Android SMS Trojan targeting users in the United States has emerged.<\/p>\n","protected":false},"author":42,"featured_media":4602,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2683],"tags":[105,537,1474],"class_list":{"0":"post-4601","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-android","10":"tag-mobile-malware","11":"tag-sms-trojans"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/fakeinst-targets-us-users\/4601\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/fakeinst-targets-us-users\/3375\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/fakeinst-targets-us-users\/3260\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/fakeinst-targets-us-users\/3681\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/fakeinst-targets-us-users\/3753\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/fakeinst-targets-us-users\/4601\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/fakeinst-targets-us-users\/4601\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/android\/","name":"Android"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/42"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=4601"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4601\/revisions"}],"predecessor-version":[{"id":33118,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/4601\/revisions\/33118"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/4602"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=4601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=4601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=4601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}