Security researchers at Kaspersky Lab have discovered five new samples of the ZeuS-in-the-Mobile (ZitMo) malware package, targeting Android and BlackBerry devices.
Zitmo (Zeus in the mobile) is the name given to the mobile versions of Zeus, and it's been around for a couple of years already, mostly infecting Android phones. The Zitmo variant has reportedly been operating for at least two years targeting Android phones by masquerading as banking security application or security add-on.
ZitMo gets hold of banking information by intercepting all text messages and passing them on to attackers' own devices. It gets onto devices inside malicious applications, which users are duped into downloading. In this case, the malicious app was posing as security software called 'Zertifikat'.
Once installed, the packages forward all incoming SMS messages to one of two command and control numbers located in Sweden, with the aim of snaring secure codes and other data. Kaspersky found mobile users in Spain, Italy and Germany were targeted by these fresh variants, with two command and control (C&C) numbers found on Sweden's Tele2 operator.
"The analysis of new Blackberry ZitMo files showed that there are no major changes. Virus writers finally fixed grammar mistake in the 'App Instaled OK' phrase, which is sent via SMS to C&C cell phone number when smartphone has been infected. Instead of 'BLOCK ON' or 'BLOCK OFF' commands (blocking or unblocking all incoming and outgoing calls) now there are 'BLOCK' and 'UNBLOCK' commands. Other commands which are received via SMS remain the same." Denis Maslennikov, a researcher at Kaspersky Lab.
The tactic is designed to help the criminals circumvent the out-of-band authentication systems used by many European banks, by hijacking the one-time password authentication password sent via SMS.
Earlier this year, Kaspersky warned of a set of malicious Android applications posing as security software. Zeus was sitting behind those apps, ready to siphon off text messages.
