IPTV-Themed Ads Spread Mobile Malware in Four Countries
Summary
Threat Fabric reports IPTV-themed campaigns in Portugal, Italy, Turkey and India that use social media ads and unofficial streaming apps to deliver mobile malware, including Antidot, Medusa and BTMOB.
Key points
- Campaigns reported in Portugal, Italy, Turkey and India follow a pattern previously observed in Spain.
- Social media ads promote football, movies or IPTV, then direct users to websites encouraging app installation.
- The apps request permissions, often Accessibility Services, that are unrelated to streaming.
- Reported payloads include Antidot in Portugal, Medusa in Italy and BTMOB in India; Turkey's activity was assessed as highly likely malicious.
- The article says major sporting events can amplify these campaigns, while the approach also applies to other premium content.
- It recommends that banks track mobile malware, share threat intelligence with fraud teams and warn customers when targeted.
- The article calls for efforts to disrupt fraudulent ads earlier in the delivery chain.
Article Details
- Event Type
- Mobile malware campaigns distributed through IPTV-themed apps and advertising
- Impact
- Campaigns reported in Spain, Portugal, Italy, Turkey, and India use social media ads and imitation websites to promote apps containing malware. The malware may steal money or collect personal data; the article provides no quantified impact.
Malware
Products
Countries
IndiaWe observed campaigns in Portugal, Italy, Turkey and India that follow the same basic flow as in Spain:ItalyWe observed campaigns in Portugal, Italy, Turkey and India that follow the same basic flow as in Spain:PortugalWe observed campaigns in Portugal, Italy, Turkey and India that follow the same basic flow as in Spain:SpainEarlier this month, we shared findings on an upcoming threat in Spain that used football piracy as a lure to distribute mobile malware.TurkeyWe observed campaigns in Portugal, Italy, Turkey and India that follow the same basic flow as in Spain: