There’s no shortage of scams about, but the latest bout of dodgy SMS is all about leaving dodgy software on certain phones.
Scams are on the increase, and because there’s seemingly no end in sight, it’s pretty much important that you’re aware of all of them, staying on top of what’s happening. However depending on what you’ve been doing lately, there’s a good chance you’ve received messages that look a little scam-like over text messages, asking you to click to get voicemail message, or even click to something you’ve missed.
As so many of us are home, it would be no real surprise if you’re concerned by a missed call, and a text suggesting you’ve missed something might be interpreted as a real issue, except the texts going around air on the dodgy side of life.
They’ll say “You have a missed call” or a misspelling of that, or even “You have 1 new Voicemail(s)”, with a link to where you can find them. Unfortunately, it’s happening everywhere, and depending on the device you have, touching that link can have very real ramifications.
Who’s calling my phone and sending it random voicemail texts?
The good news is that no one you know is calling and sending these voicemail texts. This is a scam, and a rather sneaky one, employing the use of a bit of malware called “Flubot” which can infect Android phones lacking security.
Flubot is a bit of a nasty piece of software and is very much like the phone equivalent of a virus. Installing it by accident can have it read your personal information, credit card details, send it to a centralised server, and then contact other people on your phone’s list, sending itself around once again. Avast picked up on this back in June when it was going around in Europe, and it seems as though Australia is next on the hit list, with the messages coming through to our phones now.
That doesn’t mean someone you know necessarily fell for the link in order to have this dodgy message make its way around, because in this approach, the criminals sending the message aren’t just preying on your number, but every number. Text message sends like this are likely going to a giant list, and so while you might get one or two or ten, it doesn’t mean someone you know has clicked on the malware. Rather, it just means you’re the unlucky recipient of these messages.
And you should definitely not click. No one should click the link in these messages. There is no voicemail waiting at the end of the link, and while Android is the target, there’s always a possibility that could open up in time, or even tie your phone number to a list of the gullible and have more messages get sent out.
What happens if you’re infected with Flubot?
The bad news about Flubot is that if you do click on that link, you mightn’t know you’re actually infected.
“If your device is infected with Flubot, you will not know if your personal data is being accessed, and you will not be able to see your handset sending SMSes to infect others,” said Clive Reeves, Deputy Information Security Officer at Telstra.
Largely specific to Android phone owners, at least for now, phones infected with Flubot might have a new “Voicemail” app on their devices and receive text messages or calls from people saying that you’ve sent them messages or calls, and while the telco they use might even send an SMS telling that you’re sending large amounts of text messages warning you of the problem. However this thing is an industry-wide issue, and isn’t just happening at once telco, but many around the world.
Criminals are up to something, and with scams and malware taking big dollar figures out of our pockets, it means staying on alert is important, too.
If you do end up in that situation with Flubot, your phone isn’t kaput, but you might want to head to the Google Play Store on an Android phone and download a piece of software to do it, with researchers at security group ESET advising on such a thing.
There’s no word yet on whether Telstra’s phone security defence system can actually block these messages in the long run — we’ve asked! — or whether the Optus and McAfee WiFi Secure collaboration can stop Flubot from doing dodgy things at home, too (we asked there, as well), but it does mean you need to pay close attention.
Remember: don’t click on links you don’t know
Ultimately, the real lesson from all of this is to not click on links you don’t know, especially if they come from a random number.
It’s fine to get messages and calls from random numbers, but if you normally receive an alert from your telco about voicemail messages or you know you have to dial into a specific number to hear your voicemail, that’s how you’re getting your voicemail, not through some random text out of the blue.
Scammers and criminals consistently play on the urgency and emergency of a situation to get us to click, and this one is no different, so don’t click, and just delete this so-called urgent message with the same level of urgency it seems to suggest.
