A malicious Android SMS application discovered on the Google Play Store has been found to stealthily harvest text messages with the goal of creating accounts on a wide range of platforms like Facebook, Google, and WhatsApp.
The app, named Symoo (com.vanjan.sms), had over 100,000 downloads and functioned as a relay for transmitting messages to a server, which advertises an account creation service.
This is achieved by using the phone numbers associated with the infected devices as a means to gather the one-time password that’s typically sent to verify the user when setting up new accounts.
“The malware asks the phone number of the user in the first screen,” security researcher Maxime Ingrao, who discovered the malware, said, while also requesting for SMS permissions.
“Then it pretends to load the application but remains all the time on this page, it is to hide the interface of the received SMS and that the user does not see the SMS of subscriptions to the various services.”
Some of the major services illegally signed up using the phone numbers include Amazon, Discord, Facebook, Google, Instagram, KakaoTalk, Microsoft, Nike, Telegram, TikTok, Tinder, Viber, and WhatsApp, among others.
Additionally, the data collected by the malware is exfiltrated to a domain named “goomy[.]fun,” which was previously used in another malicious application called Virtual Number (com.programmatics.virtualnumber) that has since been taken down from the Play Store.
The app’s developer, Walven, has also been linked to another Android app known as ActivationPW – Virtual numbers (com.programmatics.activation) that claims to offer “virtual numbers to receive SMS verification” from more than 200 countries for less than 50 cents.
According to Ingrao, Symoo and ActivationPW represent the two ends of the fraudulent scheme, wherein the phone numbers of the hacked devices that have the former installed are employed to help users buy accounts through the latter.
Google told The Hacker News that the two apps have been removed from the Play Store and that the developer has been banned.
