Bulgarian Android SMSsend
Summary: Cisco Talos reported that visiting a compromised Bulgarian website on an Android phone triggers a redirect and download of premium-rate SMS malware, provided the phone has "Allow installation of apps from unknown sources" enabled. The campaign involves IP address 93.170.107.184, which resolves to domains including flashupdate.org, mobiserver-russia.com, and file-send09.net, with samples distributed as flash_player_installer.apk and Android_installer-1.apk.
What's compelling: The infection path depends on a single user setting - allowing installs from unknown sources - and the payload is premium-rate SMS malware that can bill the victim directly, with dozens of domains resolving to one IP address (93.170.107.184) to keep the campaign alive.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026