November 17, 2021 By David Bisson 2 min read

A mobile premium services campaign infected over 10 million Android users with the GriftHorse Trojan.

More Than 200 Malicious Apps in Play

Discovered by Zimperium, the GriftHorse Trojan operation used more than 200 Trojan apps to target Android users all over the world.

The largest proportion of those Trojanized apps used entertainment as a theme at 12.7%. This was followed by personalization, lifestyle and simulation at 5.6%, 5.6% and 4.2%, respectively.

Once installed, a GriftHorse’s app began by pushing notifications on the infected device at least five times an hour. The campaign used that to attract the user’s attention and lure them into using the app.

In the end, Trojan campaign used one of two variants to subscribe the victim to several paid and premium SMS services.

The first version required the user to interact with a ‘Continue’ or ‘Click’ button. Doing so sent an SMS text message subscribing the victim to those services.

The second variant performed the same function as the first. However, it required that the victim enter their phone number and register it with the server’s backend before completing the subscriptions. In total, the Trojan’s operators ran this scam on over 10 million Android users in over 70 countries.

Many of those Trojanized apps charged their victims over €30 ($35) per month. Zimperium determined that attackers were using Google’s Play Store and third-party app services to distribute the malware.

The security firm reported the campaign to Google, whose researchers responded by removing the Trojanized apps from the Play Store. At the time of writing, some of the apps were still up on third-party app stores, however.

Similar Android Trojan Attacks

GriftHorse isn’t the only Android malware that’s sought to entrap victims in paid and premium SMS subscriptions.

In April 2021, for instance, Doctor Web discovered the first malware from AppGallery, the official app store for Huawei Android devices. The threat turned out to be a variant of the Joker malware Trojan that used 10 versions of itself to subscribe victims to premium mobile services.

Several months later, security researcher Lukas Stefanko uncovered another version of the Joker malware Trojan. This one used the Netflix series “Squid Game” as a lure to target victims with ad fraud and unwanted SMS subscriptions.

About a month later, Avast uncovered the UltimaSMS campaign. This used 151 apps on Google’s Play Store to enroll victims in premium SMS services.

How to Defend Against Trojan Attacks Like GriftHorse

Organizations can defend against Trojan attacks on mobile by investing in their security awareness training. Specifically, they can create modules around teaching their employees to download apps from trusted developers on official stores only. They can use that same training to teach employees some of the telltale signs of a mobile premium services campaign, such as constant notifications and suspicious recurring payment card charges.

More from News

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government. The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of…

Recent developments and updates in Biden cyber policy

3 min read - The White House recently released its budget for the 2025 fiscal year, which supports the government’s commitment to cybersecurity. The cybersecurity funding allocations line up with the FY 2025 cybersecurity spending priorities released last year that included the following pillars: Defend critical infrastructure Disrupt and dismantle threat actors Shape market forces to drive security and resilience Invest in a resilient future Forge international partnerships to pursue shared goals. In 2023, the White House released a 35-page document detailing the new…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today