Malware on the smartphone: thousands fall victim to dangerous spam SMS every day

Many cell phone users are falling into an SMS trap set by online criminals, current figures from network operators show. Increasingly, the fraudulent messages are also spreading via messengers such as WhatsApp.

Several thousand German customers of all major mobile providers are currently falling victim to dangerous spam text messages every day. Deutsche Telekom alone records an average of 7,000 to 8,000 customers a day who click on links contained in such text messages and infect their phones with malware. The figures come from analyses by the company's IT security experts, as a Telekom spokesperson explained when asked.

The experts also observe that attackers have increasingly tried to spread the spam messages via messengers such as WhatsApp or Telegram in recent days. Often, the text messages pretend to come from parcel delivery companies. Instead of information about a delivery status, the links lead users to hijacked websites where users of Android devices are asked to download a dangerous app. This hijacks the device so that it sends spam SMS messages itself.

The websites automatically detect whether the victims are using an Android smartphone and prompt them to install the malicious software only in that case. The attackers also often try to trick victims into revealing personal information in order to use it for further attacks, such as credit card fraud. This scam can also be dangerous for iOS users.

The leak full of Facebook data exacerbates the situation

"The perpetrators adapt their attacks to the habits of customers in Germany," explains a Telekom spokesperson. Among other things, they oriented themselves to when their target group is online and likely to respond to short messages. According to Telekom security analysts, bot networks known as MoqHao and Flubot are behind the attacks.

In the Vodafone network, a total of four-digit numbers of customers were also affected last month, the company said on request. Telefónica (O2) spoke of a low five-digit number in the period. It is working with law enforcement agencies to identify the perpetrators, a spokesman said.

Police authorities last warned of the fraudulent messages after it became known that phone numbers of millions of Facebook users were circulating on the net. "Since the Facebook leak became known over the Easter weekend, we have seen that the phishing text messages often include a personal salutation," a Vodafone spokeswoman said. Although Vodafone has been observing SMS spam campaigns for some time, the leak increases the risk that those affected do not question the credibility of these SMS and click on the link.