The security firm AdaptiveMobile has discovered a new variant of Koler ransomware is capable of self-replication via SMS messages.

A new strain of the Koler Android ransomware is threatening the mobile industry, the new variant spreads itself via SMSs and holds the victim’s device phone hostage until a ransom is paid.

The Koler ransomware were detected by experts at Kaspersky Lab in July, the researchers issued a report on the malware explaining that it was targeting targeting both Android devices and desktop browsers.

The first variant of the Koler Android ransomware was observed in May when the Trojan was spread through certain pornographic websites under the guise of legitimate apps.

Implementing a classic extortion scheme  locks the victim’s device display and then requests money from victims. The malware displays fake notifications from law enforcement agencies that accuse victims of viewing and storing child pornography.

Security experts from mobile security firm AdaptiveMobile have discovered a new variant of the mobile malware Worm.Koler that allows the malicious code to spread via SMS, sending shortened bit.ly URL.

The security firm has already observed thousands of messages from hundreds of infected phones, mainly located in the US.

The attack scenario is very interesting, the Koler worm sends an SMS message with a bitly link stating that an account with the user’s photos has been created. To spread itself, the koler worm first sends an SMS message to all contacts in the mobile’s address book with a text stating:

“Someone made a profile named -[the contact’s name]- and he uploaded some of your photos! is that you?” followed by a Bitly link.

The victim is re-directed to a DropBox folder containing a “PhotoViewer” app trojanized with the malware. Once installed, the maclious app locks the victim’s devices requesting the payment of a fee to unlock it.

“Once installed, the malware blocks the user’s screen with a fake FBI page, which says the device has been locked due to pornographic or other inappropriate content. The user can “wave the accusations” by paying a fine using a Money Pak Voucher. This a new approach for Koler, which used to hide on pornography sites, and is now using SMS and the wording of a well-known Facebook scam to entice users to install it. ” states the post “The device appears to be completely locked down with the screen on the phone blocked, so the user won’t be able to close the window, or deactivate the malware through the app manager,” reads the blog post. “The victim is forced to buy a voucher as instructed on the blocking page, and send the voucher code to a malware author.”