Joji Hamada's blog

We have continued monitoring the massive campaign involving SMS Fraud on the mobile platform for a while now as new activities are constantly taking place. New domains are created practically every day and new variants are being released consistently. Most activities are not really noteworthy.

Contribution: Takayoshi Nakayama

During the summer of 2011, one-click fraud targeting smartphones was discovered. One-click fraud has now become so common that doing a quick search for certain keywords on the Internet using a smartphone leads to a high possibility of coming across one of the scam sites. The typical attack simply attempts to trick users into registering for a paid service.

Recently, we discovered malware in the wild in the form of document files, such as PDF and Word, using password protection. The malware are used as attachments in email in limited, targeted attacks.

A type of fraud involving adult related content, called “one-click fraud”, has been targeting computer users in Japan for a while now. Typically, the fraud involves users attempting to access content on websites, which are usually pornography-related.

W32.Morto first made headlines in August because of its capability to spread by Windows Remote Desktop Protocol (RDP). The worm was unique because it was the first of its kind to use the protocol.  However, this wasn't the only unique aspect of the worm.

Thanks to Takayoshi Nakayama for his research and contributions to this blog.

W32.Gammima.AG, an infostealer best known for targeting massively multiplayer online role-playing games, is now also going after a game on Facebook. This is the first time we have encountered the malware going after an app on Facebook.

Symantec Security Response has confirmed that the Microsoft Internet Explorer Time Element Uninitialized Memory Remote Code Execution Vulnerability is being exploited in the wild.

Malicious authors have taken a variety of popular free apps from the official Android market and bundled them with malware capable of rooting the phone, harvesting data, or opening a backdoor.