Zimperium experts discovered the GriftHorse malware targeting Android. This malware has been active since November 2020 and subscribes its victims to paid SMS services. It has already infected more than 10 million devices in 70 countries around the world, and GriftHorse operators are believed to “earn” between $ 1.5 million and $ 4 million a month.
The versions of GriftHorse noticed by experts were distributed through the official Google Play store and third-party application catalogs, as a rule, disguised as other harmless applications.
If the user installs such an application, GriftHorse begins to bombard him with pop-ups and notifications, which offer various prizes and special offers. If the victim clicks on one of these notifications, they are redirected to a page where they are asked to verify their phone number, ostensibly to access the offer. In fact, here users subscribe to paid SMS services, the cost of which sometimes exceeds 30 euros per month. This money ends up going into the pockets of the GriftHorse operators.
Zimperium researchers, who have been tracking malware for several months, write that this is “one of the largest campaigns that the zLabs team witnessed in 2021.”
It is emphasized that the creators of GriftHorse have worked hard to improve the quality of their malicious code, and use a wide range of sites, malicious applications and developer personalities to avoid detection.
“The level of sophistication, the use of new techniques and the determination shown by the attackers allowed them to remain undetected for months. In addition to using a large number of applications, their distribution was very well planned: applications were distributed into many different categories, expanding the circle of potential victims, experts write. – This campaign has been actively developed for several months starting in November 2020, with the last update dated April 2021. This means that one of their first victims, if she hasn’t turned off the fraudulent subscription already, has already lost more than € 200 at the time of writing.
A list of over 200 applications infected with GrifThorse can be found at the end report researchers.