Over 105,000 Malware Samples Identified

Key Findings:

Over 95% are/were unknown and unavailable malware samples

Malware hijacked OTP text messages across more than 600 global brands

Approx. 4,000 samples contained phone numbers pre-embedded within Android kit

13 C&C servers used to communicate and potentially receive stolen SMS messages

Over 2,600 Telegram bots linked to campaign, serving as a distribution channel

Zimperium, the leading global provider of mobile security solutions, announces the discovery of a new and potent threat identified as the SMS Stealer. This malicious software, uncovered by Zimperium’s zLabs team during routine malware analysis, has been identified in over 105,000 samples, across more than 600 global brands, highlighting its extensive reach and significant risks, including account takeovers and identity theft.

The SMS Stealer threat, first identified in 2022, uses fake ads and Telegram bots posing as legitimate services to trick victims into gaining access to their SMS messages. Once access is granted, the malware connects to one of its 13 Command and Control (C&C) servers, confirms its status, and begins transmitting stolen SMS messages, including one-time passwords (OTPs).

OTPs are designed to add an extra layer of security to online accounts, particularly for enterprises controlling access to sensitive data. However, the SMS Stealer’s ability to intercept OTPs undermines this security feature, giving bad actors the means to gain control of victims’ accounts. The malware associated with SMS Stealer remains hidden, allowing for continuous attacks.

The Impact of SMS Stealer:

Credential Theft: The malware can intercept and steal OTPs and login credentials, leading to complete account takeovers.

Malware Infiltration: Attackers may use stolen credentials to infiltrate systems with additional malware. Increasing scope and severity of attack.

Ransomware Attacks: Stolen access can be leveraged to deploy ransomware, leading to data encryption and significant financial demands for data recovery.

Financial Loss: Attackers can make unauthorized charges, create fraudulent accounts, and facilitate significant financial theft and fraud.

“The SMS Stealer represents a significant evolution in mobile threats, highlighting the critical need for robust security measures and vigilant monitoring of application permissions,” said Nico Chiaraviglio, Chief Scientist at Zimperium.  “As threat actors continue to innovate, the mobile security community must adapt and respond to these challenges to protect user identities and maintain the integrity of digital services.”

For more details on SMS Stealer read our technical blog here.

About zLabs

Zimperium’s zLabs is a world-renowned mobile security research team dedicated to discovering and analyzing the latest mobile threats. Through curing-edge research and innovative analysis techniques. zLabs provides critical insights and solutions that drive Zimperium’s industry-leading security products. The team’s work is instrumental in identifying emerging threats and developing strategies to protect mobile users worldwide.

About Zimperium

Zimperium is the world leader in mobile security for iOS, Android and ChromeOS. Zimperium solutions, including Mobile Threat Defense (MTD) and Mobile Application Protection Suite (MAPS), offer comprehensive mobile security for enterprises. MTD is a privacy-first application that provides mobile risk assessments, insights into application vulnerabilities, and robust threat protection. It is used to secure both corporate-owned and bring-your-own (BYO) devices against advanced mobile threats across device, network, phishing, app risks, and malware vectors. MAPS delivers in-app protection to safeguard applications from attacks and ensure data integrity. Together, these solutions empower security teams to effectively manage and mitigate mobile threats. Zimperium is headquartered in Dallas, Texas and backed by Liberty Strategic Capital and SoftBank. For more information, follow Zimperium on X (@Zimperium) and LinkedIn, or visit www.Zimperium.com