Chinese Android trojan buys applications

Mobile security company TrustGo has detailed the discovery of a new type of Android malware which operates in China. The trojan – which the company has dubbed MMarketPay.A – is being distributed in nine different third party app stores. When installed on a phone, the trojan is able to buy applications from China Mobile's own marketplace; these purchases then get billed to the victim.

According to TrustGo, the malware has already infected "more than 100,000 devices". The trojan targets China Mobile's Mobile Market distribution platform. China Mobile is one of the largest mobile phone carriers worldwide, with approximately 677 million subscribers. Customers on the China Mobile network can visit the market's web site and are able to purchase applications and content without having to log in. The phone is then authenticated based on the fact that it uses a China Mobile Access Point Name (APN). When users purchase an application, they receive a text message with a verification code that will then have to be entered on the web site to finalise the purchase.