A trojan is a malicious piece of software that disguises itself as another program in order to gain access to a system, hence the name.

 

The new malware is being distributed via Russian-language sites that come out on top of search results for pornographic websites.

 

The new Trojan disguises itself as a media player just as its predecessor had done. It's named Trojan-SMS.AndroiOS.FakePlayer.b and masquerades as a media player required to display adult content videos.

 

Trojans can only infect smartphones if the user manually installs the application, hence users are asked to download an application named pornplayer.apk. This 16.4 KB installation file installs the malicious software and also asks the users' consent to send SMS messages from their phone, something media players would almost never need to do.

 

Once the fake application is launched the trojan starts sending SMS messages to a premium rate number without the users knowledge. These SMS messages cost $6 (R42) each, resulting in huge bills being transferred to the cyber criminals accounts.

 

“Android users should pay close attention to the services that an application seeks permission to access,” said Denis Maslennikov, mobile research group manager at Kaspersky Labs. “Automatically permitting a new application to access every service that it says it needs to means you could end up with malicious or unwanted applications doing all sorts of things without requesting any additional information.”

 

Similarities between this latest trojan and Trojan-SMS.AndroidOS.FakePlayer.a, the first Trojan-SMS program that was detected by Kaspersky a month ago, suggests both applications stems from the same person or group.

 

Kaspersky Labs predicts that more malicious programs will start surfacing in the coming months as cyber criminals continue to exploit weaknesses in the Android operating system (OS), currently the fastest growing mobile OS on the market.