Mobile Threat Report records a list of firsts for Android malware, including the first non-app-related distribution
Android is facing some alien invaders in the form of additional malware threats spotted in the first quarter of 2013, according to a new report.
The first quarter of 2013 was marked by firsts for Android malware that add complexity to the Android threat landscape, stated F-Secure Labs' latest Mobile Threat Report.
Android threat distribution went outside of apps for the first time in the quarter, via email spam, while there were also the first targeted Android attacks, and the first Android advanced fee fraud scam. Additionally, examples of increased commoditisation of Android malware surfaced, said F-Secure. The number of new mobile threat families and variants continued to rise by 49% from the previous quarter, from 100 to 149. Of those, 136 (91.3%) were Android and 13 (8.7%) Symbian. First quarter numbers are more than double that of a year ago in the same quarter 2012, when 61 new families and variants were discovered. The new Android techniques are a cause for concern, said Sean Sullivan, security advisor at F-Secure Labs. 'I'll put it this way; until now, I haven't worried about my mother with her Android because she's not into apps. Now I have reason to worry because with cases like Stels, Android malware is also being distributed via spam, and my mother checks her email from her phone.' The Android trojan known as Stels began distributing via fake U.S. Interal Revenue Service-themed emails, using an Android crimeware kit to steal sensitive information from the device, and monetising by making calls to premium numbers. This example of mobile malware commoditisation could be a game changer, according to Sullivan. Also, the quarter saw the first targeted attacks in the mobile space. Tibetan human rights activists were targeted with emails that contained an Android-malware-infected attachment, and a so-called 'coupon app' for a popular coffee chain stole information from phones with South Korean country codes. Mobile is being targeted in India, as the discovery of the first Android advanced fee fraud proved. A fake job offer Android app in India informs that the user is being considered for a position at TATA Group, an Indian multinational company. To arrange the interview, the app asks for a refundable security deposit.
