How to protect your phone against Xafecopy malware that's stealing money from you

2017  has witnessed numerous ransomware and malware attacks. The new malware Xafecopy Trojan, which steals money from mobile phone users, has been recently detected by a Russia-based internet security firm Kaspersky.  What's alarming is that the penetration rate reveals  40 per cent of the malware's targets has been in India.

The Xafecopy Trojan is categorised as a malware because it gets side loaded along with other useful apps and then loads malicious code onto the device.

Here is how the Xafecopy Trojan works:

The major entry point for any malware or ransomware is the installation of unverified apps from unknown sources. While the default setting of most smartphones restricts installing any app from an unknown source, the setting can easily be changed by the user.

Once the unverified app affected with Xafecopy Trojan or any other malware is installed and activated in the mobile phone, they spread in the root files of the smartphone and operate discreetly.

The Xafecopy malware clicks on web pages with Wireless Application Protocol (WAP) billing - a form of mobile payment that required no credit/debit card information or CAPTCHA for security. The cost of purchases made through WAP billing is charged directly through the user’s bill.
READ MORE

WannaCry ransomware: 48k cyber attack instances in India, says Quick Heal

Security software maker Quick Heal said on Tuesday it had detected over 48,000 instances of the WannaCry ransomware attack in India, targeting both enterprises as well as individuals using systems running Microsoft’s Windows OS.

The WannaCry bug, for which India’s Computer Emergency Response Team (CERT-In) issued a critical warning on April 13, has reportedly crippled hundreds of thousands of systems, especially healthcare and transport networks, across 150 countries. In a webcast on Monday, CERT-In said India had not been affected by the attack as badly as many other countries.

Quick Heal said the ransomware attack was not focused towards any particular industry but was spread across industries, “especially those organisations which are online and connected”.

graph “In the last few days, we have received distressed calls from customers belonging to verticals like education, banking, financial, manufacturing, healthcare and even from a few services sectors,” said Sanjay Katkar, managing director and chief technology officer of Quick Heal.

The IT security solutions provider said 60 per cent of the attacks were targeted at enterprises and rest at individuals in India. Kolkata saw the most attacks, followed by Delhi, Bhubaneshwar, Pune and Mumbai.

The WannaCry bug encrypts critical files on a computer it infects, with the attackers demanding $300 paid through Bitcoin to regain access to those files.

CERT-In on Monday advised victims of the attack to not pay the ransom and wait for researchers to develop a key with which they would be able to unlock their data.

Both CERT-In and Quick Heal have advised the system administrators and individuals to update Windows with the latest security patches issued by Microsoft. Further, users can take backups of their data to ensure that they do not lose it in case their systems get infected with the ransomware.
READ MORE