Android trojan used to create simple SMS spam botnet

Jump to navigation Jump to search

(Publication) Google search: [1]

Android trojan used to create simple SMS spam botnet
Botnet SpamSoldier
Botnet/malware group
Exploit kits
Distribution vector
Operation/Working group
Date 2012 / 2012-12-16
Editor/Conference Cloudmark
Link (Archive copy)
Author Andrew Conway
Type Blogpost


A new crop of trojan mobile applications are demonstrating simple mobile botnet behavior, leveraging infected handsets to spread spam and invitations for other users to download the infected apps. This new evolution of malicious mobile applications is presently being monitored by the Cloudmark mobile security research team who had been investigating a strong uptick in mobile originated spam over the past week.

A random invitation received via SMS to download a free version of a popular Android game like The Need for Speed Most Wanted or Angry Birds Star Wars may seem enticing, but as your intuition may hint the offer is often times too good to be true. If you do download this “spamvertised” application and install it on your Android handset, you may be unknowingly loading a malicious software application on your phone which will induct your handset into a simple botnet, one that leverages the resources of your mobile phone for the benefit of the malware’s author. In the case of this latest batch of SMS sending malware that the Cloudmark Research team has been monitoring, your phone will be used to silently send out thousands of spam SMS messages without your permission to lists of victim phone numbers that the malware automatically downloads from a command and control server. You better have an unlimited message plan or your phone bill may come as a bit of a shock.


 @misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2012BFR27,
   editor = {Cloudmark},
   author = {Andrew Conway},
   title = {Android trojan used to create simple SMS spam botnet},
   date = {16},
   month = Dec,
   year = {2012},
   howpublished = {\url{}},