New WAPDropper Mobile Malware

Summary

Check Point researchers discovered a new mobile malware, dubbed WAPDropper, with stealthy capabilities of subscribing victims to premium-rate services from legitimate telecommunications providers in Malaysia and Thailand. Although this campaign is limited to Southeast Asian providers, similar schemes may be used in other regions of the world, including the US. WAPDropper contains a dropper module to download and execute the additional malware—a premium dialer module—and then uses machine learning to bypass image-based CAPTCHA challenges. 

Recommendations

The NJCCIC recommends users keep mobile device operating systems and applications up to date, download and install reputable apps from official app stores, implement and configure security and privacy settings, disable the installation of applications from third-party sources, enable multi-factor authentication (MFA) where available, and exercise caution with suspicious communications, websites, and apps. For more information, please see the Check Point blog post.