Microsoft warns that toll fraud malware is one of the most prevalent threats on Android and has detailed its evolving capabilities pointing out its “complex multi-step attack flow” and an improved mechanism to evade security analysis.
Toll fraud is a subset of billing fraud in which malicious mobile applications come with hidden subscription fees, luring unsuspecting users to premium content without their knowledge or consent.
The difference is that toll fraud does not work over WiFi and are only carried out when a compromised device is connected to one of its target network operators.
By default, it uses cellular connection for its activities and forces devices to connect to the mobile network even if a Wi-Fi connection is available.
Dimitrios Valsamaras and Sang Shin Jung of the Microsoft 365 Defender Research Team stated that once the connection to a target network is confirmed, it stealthily initiates a fraudulent subscription and confirms it without the user’s consent, in some cases even intercepting the one-time password (OTP) to do so.
Such apps also suppress SMS notifications related to the subscription to prevent the victims from becoming aware of the fraudulent transaction and unsubscribing from the service.
The toll fraud takes advantage of the payment method which enables consumers to subscribe to paid services from websites that support the Wireless Application Protocol (WAP). This subscription fee gets charged directly to the users’ mobile phone bills, thus preventing the need for setting up a credit or debit card or entering a username and password.
If the user connects to the internet through mobile data, the mobile network operator can identify him/her by IP address. Mobile network operators charge users only if they are successfully identified.
Here, the malware performs the subscription on behalf of the user in a way that the overall process isn’t perceivable. The malware will communicate with a [command-and-control] server to retrieve a list of offered services.
It conducts this by first turning off Wi-Fi and turning on mobile data, followed by making use of JavaScript to stealthily subscribe to the service, and intercepting and sending the OTP code (if applicable) to complete the process.
The JavaScript code, for its part, is designed to click on HTML elements that contain keywords such as “confirm,” “click,” and “continue” to programmatically initiate the subscription.
After a successful fraudulent subscription, the malware either conceals the subscription notification messages or abuses its SMS permissions to delete incoming text messages containing information about the subscribed service from the mobile network operator.
Toll fraud malware hides its malicious behavior by means of dynamic code loading, a feature in Android that allows apps to pull additional modules from a remote server during runtime, making it ripe for abuse by malicious actors.
This means that a malware author can fashion an app such that the rogue functionality is only loaded when certain prerequisites are met, effectively defeating static code analysis checks.
With an install rate of 0.022%, toll fraud apps accounted for 34.8% of all PHAs installed from the Android app marketplace in the first quarter 2022, ranking second below spyware. Most of the installations are from India, Russia, Mexico, Indonesia, and Turkey.
In order to mitigate the threat of toll fraud malware, it is suggested that users must install applications only from the Google Play Store or other trusted sources, avoid providing excessive permissions to apps, and consider upgrading to a new device if it does not receive software updates.
Comments