The zLabs security research team has been tracking the development of a new variant of the FakeCall malware. This is a form of Vishing (voice phishing), where attackers use fake calls or voice messages to trick victims into providing sensitive information such as login credentials, credit card numbers, or bank account details.

Mishing techniques in FakeCall

Mishing is a term that encompasses phishing techniques targeting mobile devices, exploiting features like calls, messaging, and cameras. FakeCall includes the following mishing techniques:

• Vishing (voice phishing): Attackers use fake calls to trick victims into revealing sensitive information or performing unusual actions.

• Smishing (SMS phishing): Attackers send fraudulent SMS messages to lure victims into clicking malicious links or sharing sensitive information.

• Quishing (QR code phishing): Exploiting malicious QR codes for phishing attacks.

• Email-based mobile phishing: Attackers craft specially designed emails to execute phishing when accessed through mobile email apps.

Notably, FakeCall has a highly sophisticated Vishing attack mechanism, using malware to almost completely control the mobile device, including intercepting incoming and outgoing calls. This results in victims being redirected to malicious phone numbers controlled by attackers while the phone interface still displays the normal call number.

How FakeCall works

The attack begins when the victim downloads an APK file onto an Android device. This file acts as a dropper, with its main task being to install malicious payloads (FakeCall) onto the victim's device.

The FakeCall malware is designed to communicate with a Command and Control (C2) server, allowing it to receive commands to perform various actions to deceive users.

Figure 1. FakeCall’s attack chain

When launched, the application will prompt the user to set it as the default call handler. Once set as the default call handler, the application can manage all incoming and outgoing calls. Combined with OutgoingCallReceiver, the application captures the intent android.intent.action.NEW_OUTGOING_CALL and extracts the phone number using the getResultData() function. The application then displays a fake interface of the original com.android.dialer app, but with integrated malicious functions.

Figure 2: FakeCall's fake interface on the victim's device

Features of the New FakeCall Variant

Bluetooth Receiver and Screen Receiver

The new variant of FakeCall adds features like Bluetooth Receiver (monitoring Bluetooth status) and Screen Receiver (monitoring screen on/off status). Although there is no evidence of malicious behavior from these features yet, they may serve as new functions in future versions.

Accessibility Service

Another prominent feature is the Accessibility Service, which allows the malware to control the user interface and record screen events. Typical features include:

• Monitoring Dialer Activity: Monitoring dialing activity, allowing the malware to detect when the user makes a call.

• Automatic Permission Granting: Automatically granting permissions without user consent.

• Remote Control: Remotely controlling the entire device interface, allowing attackers to simulate user interactions.

Phone Listener Service

This feature acts as an intermediary communication channel between the malware and the Command and Control (C2) server, allowing attackers to issue commands and perform actions on the infected device. Some commands are listed below:

Furthermore, this new variant also has more advanced commands to serve the purpose of controlling and interacting with the victim's device:

Impact Level

The main function of this malware is to monitor outgoing calls and transmit this information to an external Command and Control (C2) server. However, its impact is quite significant:

• Identity Fraud: By tricking users into setting it as the default call handler, the application can manipulate dialing by replacing legitimate numbers with fake ones through the setResultData() method, deceiving users into making fraudulent calls.

• Hijack Calls: The malware can intercept and control incoming and outgoing calls, even creating fake calls. Users may not be aware of this until they remove the application or restart the device.

An example attack scenario is:

• When the victim attempts to contact their financial institution, the malware redirects this call to a fake number controlled by the attacker.

• This malicious application deceives users by displaying a fake call interface identical to the Android call interface, showing the victim the real bank's phone number.

• The victim will not be aware of this deception because the attacker also mimics behaviors similar to a real bank to trick the victim.

• Finally, the attacker tricks the victim into revealing sensitive information and uses it to gain unauthorized access to the victim's financial accounts.

Recommendations

FPT Threat Intelligence recommends organizations and individuals take several measures to prevent this malware:

• Educate and raise user awareness: Enhance awareness of Vishing, Smishing, and Quishing threats.

• Do not download applications from unknown sources: Recommend users only install applications from Google Play or trusted sources.

• Be cautious with app permissions: Before granting permissions to an app, users should check if the request is reasonable for the app's functionality.

• Use mobile security software: Install mobile security applications with anti-malware features.

• Regularly update software and operating systems: Google and phone manufacturers regularly release security patches. Updating devices helps users avoid security vulnerabilities that malware can exploit.

• Limit app permissions: Use features to restrict access permissions as needed, allowing users to grant permissions only when the app truly needs them and suspend them when not necessary.

• Use multi-factor authentication (MFA): Apply multi-factor authentication for bank accounts and important accounts.

• Monitor new malware variants: Use Threat Intelligence services to receive the latest notifications about malware and malicious campaigns.

IOCs related to FakeCall malware

Hashes

Package name

IPs

Domains

References

• Mishing in Motion: Uncovering the Evolving Functionality of FakeCall Malware

• FakeCall Android Trojan Evolves with New Evasion Tactics and Expanded Espionage Capabilities