Hackers Using Android Malware to Compromise Diabetic Patients Android Devices To Send Premium SMS

A researcher from Fortinet discovered a new Android malware via an application called “Treatment for diabetic” that targeting diabetic patients Android devices.

It also sends a premium SMS to phone number 5554 in between providing medical information about this condition by the users of this Android app.

A malicious app posed a diabetic recource

The app provides documentation on the different forms of diabetes and its diagnosis, facts and myths, the symptoms of diabetes, information about treatment and insulin, etc.

Axelle Apvrille from Fortinet dig deep into the app and found that the malicious application requests permission to send this SMS message in the manifest, which completely suspicious activity when it comes to diabetes based application.

Request for SMS permission in the manifest

The app also checks whether the targetted Android app has running in Android 6.0 and beyond and check whether the permission is present or not, if not, it requests the permission.

Code for managing SMS permission request

According to Fortinet research “Sending an SMS only occurs once. Once the routine has run, the code inserts the value was into the field was of table1 in movieplayer.db.”

” Who is behind the phone number 5554 receiving the SMS message? It looks like a premium-rate SMS, typically used by malicious Trojan dialers to steal money from a victim, but we do not know the country, its cost, or even if it is still active.” Axelle said.

Android users also advised checking before install any medical-related apps to avoid such risks.

IOCs

sha256: cf661506978f088f276a5a5bc4f0ea71101f99941840dd0864b2068ee2eb2271

Also Read: CallerSpy Android Malware Advertised as Chat App Steals Call Logs, SMS, Contacts & Files on the Infected Device

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Top Ransomware Groups Target Financial Sector, 406 Incidents Revealed

Flashpoint analysts have reported that between April 2024 and April 2025, the financial sector emerged…

13 hours ago

Agenda Ransomware Group Enhances Tactics with SmokeLoader and NETXLOADER

The Agenda ransomware group, also known as Qilin, has been reported to intensify its attacks…

13 hours ago

SpyCloud Analysis Reveals 94% of Fortune 50 Companies Have Employee Data Exposed in Phishing Attacks

SpyCloud, the leading identity threat protection company, today released an analysis of nearly 6 million…

14 hours ago

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect servers…

16 hours ago

Healthcare Sector Becomes a Major Target for Cyber Attacks in 2025

The healthcare sector has emerged as a prime target for cyber attackers, driven by the…

16 hours ago

SysAid ITSM Vulnerabilities Enables Pre-Auth Remote Command Execution

Security researchers have disclosed a chain of critical vulnerabilities affecting SysAid ITSM’s On-Premise solution, enabling…

16 hours ago