Pierluigi Paganini February 21, 2022

Crooks abuse some SMS PVA services that allow their customers to create disposable user accounts to conduct malicious activities.

While investigating SMS PVA services (phone-verified account services), Trend Micro researchers discovered a rogue platform using a botnet of thousands of Android devices used to carry out malicious activities.

SMS PVA services provide alternative mobile numbers used by customers to register for online services and platforms. SMS PVA services could be abused to bypass SMS verification mechanisms, attackers can register disposable accounts in bulk or create phone-verified accounts to use for fraudulent activities.

Owners of compromised smartphones are not aware that their devices have been compromised and these services have access to private data, messages, and applications. The operators behind this campaign used Guerrilla malware (“plug.dex“) to capture and parse SMS messages received on infected Android devices, check and exfiltrate data of interest.

The malicious code used specially crafted regex provided by the C&C to analyze only SMSs that match specific conditions in an attempt to avoid raising suspicion. Experts pointed out that if the SMS PVA service allows its customers to access all messages on the infected phones, the owners would quickly discover the compromise. 

Top seven affected smartphone brands and models are Lava, ZTE, Mione, Meizu, Huawei, Oppo, and HTC.

Most of the infections have been observed in Southeast Asia (Indonesia, Thailand), South Asia (India, Bangladesh), the Middle East (United Arab Emirates), and Eastern Europe.

One of the SMS PVA services analyzed by the experts, smspva[.]net, supports a broad range of platforms for which it can extract the verification code by parsing the SMS verification message.

smspva[.]net supports several popular messaging apps (LINE, WeChat, WhatsApp, Telegram), social media (TikTok, Twitter, Facebook), payment and finance (PayPal, Alipay, MoneyLion), content livestream (17LIVE aka LIVIT, EME Hive), or online shopping apps (Jingdong, Flipkart).
The large number of messaging apps supported by smspva[.]net is likely linked to increased to spam and fraud from fake accounts in these platforms.

Trend Micro speculates the Android devices have been infected with SMS-intercepting malware, through malware downloaded accidentally by the user or through malicious software preloaded into the devices as result of a compromise of the supply-chain.

The advertising for the service claims the availability for a “bulk virtual phone numbers (across more than 100 countries)” that could be used on various platforms via an API.

“In August 2020, ReceiveCode’s first post advertised “bulk virtual phone numbers” for use on various
platforms such as Facebook, Google, Hotmail, Yahoo, Vkontakte, TikTok, Amazon, Alibaba, Uber, Twitter,
YouTube, LinkedIn, and Instagram. Based on the account name alone, one can already tell that it enables
one to receive the SMS verification code when registering to online services.” reads the analysis published by Trend Micro.

Experts also reported that the authentication processes for new accounts often leverages cross-checking the location (i.e., IP address) of the users against their phone numbers during registration. SMS PVA services avoid this restriction by using residential proxies and VPNs to connect to the desired platform.

“SMS verification has become the default authentication method for many online platforms and applications. Many IT departments treat SMS verification as a “secure” black box validation tool for user accounts. Currently, however, online services and platforms should be wary about heavily relying on SMS verification.These SMS PVA services prove that cybercriminals are indeed able to defeat SMS verification at scale.” concludes the report. “This also means that there could be authenticated and verified accounts on platforms that behave like bots, trolls, or fraudulent accounts. “

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, SMS PVA services)

[adrotate banner=”5″]

[adrotate banner=”13″]