Is there malware on your phone? Microsoft has warned users of an Android malware called “toll fraud” that can drain the money in your wallet. Compared to other subcategories of billing fraud, which include SMS fraud and call fraud, toll fraud has unique behavior. SMS fraud or call fraud use a simple attack flow to send messages or calls to a premium number, while “toll fraud” has a complex multi-step attack flow that malware developers continue to improve, Microsoft said in a blog post.

“Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve,” the blog post read.

The company warned by saying, “for example, we saw new capabilities related to how this threat targets users of specific network operators. It performs its routines only if the device is subscribed to any of its target network operators. It also, by default, uses cellular connection for its activities and forces devices to connect to the mobile network even if a Wi-Fi connection is available.”

Also Read: Shocker! Mark Zuckerberg threatens Facebook employees; here is what ‘ruthless’ CEO wants

“Once the connection to a target network is confirmed, it stealthily initiates a fraudulent subscription and confirms it without the user’s consent, in some cases even intercepting the one-time password (OTP) to do so. It then suppresses SMS notifications related to the subscription to prevent the user from becoming aware of the fraudulent transaction and unsubscribing from the service,” Microsoft said.

Another unique behavior of toll fraud malware is its use of dynamic code loading, which makes it difficult for mobile security solutions to detect threats. Despite this evasion technique, Microsoft has identified characteristics that can be used to filter and detect this threat.

Mitigating…