Careful, the Next Premium SMS Offer You Subscribe to May Be Malicious

Avast recently reported that SMSFactory Android Trojan has affected around 165,000 users worldwide.¹ But so far, only a few digital properties have been publicized as indicators of compromise (IoCs).²

If you don’t want to lose as much as US$336 a year to cybercriminals, our detailed threat research materials may be able to help.

Our deep dive into the threat revealed that:

• The threat actors behind SMSFactory Android Trojan typically used newly registered domains (NRDs).

• The domain IoCs resolved to three unique seemingly dedicated IP addresses.

• Close to 200 domains shared the IoCs’ IP addresses, three of which have been dubbed “malicious.”

• Almost half of the possibly connected domains hosted the same content as the three malicious web properties identified.

• Nearly 1,200 domains shared common strings with the IoCs, four of which are already considered malicious.

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

---

• [1] https://blog.avast.com/smsfactory-android-trojan
• [2] https://otx.alienvault.com/pulse/629c7c22660f94c3764f9e6a