Malware Used to Advertise Shady Android Spy App on Craigslist

snoopy · Aug 27, 2013

August 27th, 2013, 11:00 GMT · By Eduard Kovacs
Malware Used to Advertise Shady Android Spy App on Craigslist
Security researchers from Solera Networks, a Blue Coat company, have come across an interesting malware that’s currently being utilized to advertise a shady Android spy application on Craigslist.
It all starts with a Trojan disguised as a browser add-on called Adobe Photo Loader.

When installed, the threat downloads and executes a genuine Flash Player update to avoid raising any suspicion. In the meantime, it starts posting ads on Craigslist to advertise a site that hosts the Android spy application.

So how does the Trojan manage to post ads on Craigslist?
When executed, the bot contacts its command and control server hosted on myemail3.info. The server provides it with the text of the advertisement that will be published on Craigslist and an outlook.com email address that’s used to post the spam message.

The email address is needed because messages become visible on the classified ads website only after the poster clicks on a validation link received via email.

The bot receives the content of the validation email and “clicks” on the validation link to publish the spam message.

“The bot tries to fly under the radar by only posting one message per 24 hour period in the localized edition of Craigslist nearest the infected user’s computer,” Blue Coat Director of Threat Research Andrew Brandt wrote in a blog post.
Click to expand...

More on this story here: http://news.softpedia.com/news/Malw...dy-Android-Spy-App-on-Craigslist-378461.shtml

Log in or Sign up

Malware Used to Advertise Shady Android Spy App on Craigslist

snoopy Registered Members

Share This Page

Log in or Sign up

Malware Used to Advertise Shady Android Spy App on Craigslist

snoopy Registered Members

Share This Page

Useful Searches