Microsoft warns of the potential threat of toll fraud malware on Android devices

Android users are being attacked by malware that unwittingly purchases premium subscription services that they did not want or sign up for, according to a blog from Microsoft Security.

In a report from Microsoft researchers Dimitrios Valsamaras and Sang Shin Jung, the pair detailed the continuing evolution of “toll fraud malware” and the ways it attacks Android users and their devices. According to the team, toll fraud malware falls under the subcategory of billing fraud “in which malicious applications subscribe users to premium services without their knowledge or consent” and “is one of the most prevalent types of Android malware.”

Toll fraud works over the Wireless Application Protocol (WAP), which allows consumers to subscribe to paid content and add the charge to their phone bill. Because this attack relies on a cellular network to do the dirty business, the malware might disconnect you from Wi-Fi or use other means to force you onto your cellular network. While connecting to the cellular network the malware will start subscribing to premium services while also hiding any one-time passwords (OTP) sent to verify your identity. This is to keep targets in the dark so that they don’t unsubscribe.

The evolution of toll fraud malware from its dial-up days presents a dangerous threat, researchers warn. The malware can lead to victims receiving significant mobile bill charges. Additionally, affected devices also have increased risk because the malware is able to evade detection and can achieve a high number of installations before a single variant can be removed.

How does this malware even end up on my device in the first place?

This type of attack starts when a user downloads whatever app the malware is disguised as in the Google Play Store. These trojan apps will usually be listed in popular categories in the app store such as personalization (wallpaper and lock screen apps), beauty, editor, communication (messaging and chat apps), photography, and tools (like cleaner and fake antivirus apps). The researchers say that these apps will ask for permissions that don’t make sense for what is being done (i.e. a camera or wallpaper app asking for SMS or notification listening privileges).

The…