Keeping Android smartphones and tablets safe from malicious apps is a constant battle for enterprises, end users and for Google – now the Check Point mobile research team has discovered new Android malware that it has dubbed CallJam.
CallJam malware includes a premium dialler to generate fraudulent phone calls as well as a rough adnet capable of displaying ads forcibly to its victims.
The malware is hidden inside the game “Gems Chest for Clash Royale” which was uploaded to Play in May. Since then, the game has been downloaded between 100 000 and 500 000 times.
Check Point has notified Google about the malware.
CallJam redirects victims to malicious websites that generate fraudulent revenue for the attacker. The app also displays fraudulent ads on these websites instead of displaying them directly on the device.
Before it can make premium calls, the app requests permission from the user. As has been seen in previous similar attacks, most users grant permissions willingly, often without reading or fully understanding information about the permissions they are granting.
The C&C server then sends CallJam a command with a targeted premium phone number and the desired length of the call. Then it initiates a call using the parameters provided, generating potentially large revenues for the attackers.
Some Android users who downloaded the infected game noticed this strange activity. Since it deceives the users as part of its activity, the game has been able to achieve a relatively high rating. Users are asked to rate the game before it initiates under the false pretence that they will receive additional game currency – another reminder that attackers can develop high-reputation apps and distribute them on official app stores, putting devices and sensitive data at risk.
