Hackers infect Android devices by exploiting a vulnerability in SMS verification services

The discovery of a rogue platform built on top of a botnet came as a result of an investigation into SMS Phone-Verified Account (PVA) services. Most of the devices affected are low-cost Android phones made by original equipment manufacturers like Lava, ZTE, Mione, Meizu, and Huawei. 

Guerrilla is a piece of malware that parses SMS messages sent to infected Android phones. Without the owners’ knowledge or approval, the botnet operator employs an army of hacked devices to receive, analyze, and report SMS verification codes. It enables quick access to thousands of mobile phone numbers in various countries.

According to the company’s telemetry data, the majority of the infections are concentrated in the following countries:

• Indonesia (47,357)
• Russia (16,157)
• Thailand (11,196)
• India (8,109)
• France (5,548)
• Peru (4,915)
• Morocco (4,822)
• South Africa (4,413)
• Ukraine (2,920)
• Malaysia (2,779)

The researchers concluded that the presence of SMS PVA services tarnishes the integrity of SMS authentication as the primary method of account validation.