An SMS Trojan was spotted in the Google Play marketplace, distributed via a series of wallpaper apps that may look legitimate at first glance but connect to a Dropbox account to download an additional package named “Activator.apk”. Bitdefender said in a blogpost.
On download, the package notifies the user it’s about to install and that “services that cost you money” are about to be used. Although it’s a one-time-only process, the “Activator.apk” immediately prompts for uninstall after sending the premium rated SMS messages so it can successfully hide its existence.
The screenshot below illustrates how “Activator.apk” is downloaded from a Dropbox account:
Source: SoftwareCasa
