The Selfmite worm that attacks Android phones and sends out text messages has made a reappearance, prompting security researchers to warn the new version is more dangerous and widespread this time.
According to IT security firm AdaptiveMobile, the worm first surfaced in June. This latest version, Selfmite.b, has infected many more users, uses several techniques to extract money from victims and is "difficult to stop".
Around 150,000 messages have been tracked as being sent by the worm over the last ten days in 16 countries a hundred times the number of messages generated by the previous version of the malware.
As in the previous version, Selfmite infects a user's phone if they click on a link in a text message reading "Hi buddy, try this, its amazing u know," and "Hey, try it, its very fine." Following the link download installs an APK file, which is a trojanised Google Plus app infected with the worm.
The worm then connects with a remote server and downloads a configuration file containing data that is used to spread the infection.
Whereas the previous version just spammed 20 contacts in a user's address book, this latest version sends a message to all contacts in a loop until the mobile operator detects a problem and blocks messages.
The worm uses multiple "touch points" to encourage the victim to do things that make money for the hacker.
Users are either directed to an application in Google Play after clicking on the installed worm icon, or they click on icons that Selfmite.b has placed on their desktops and are therefore redirected to unsolicited subscription websites. The worm also varies content according to IP addresses, meaning users in different countries will be redirected to different websites.
While iPhone users aren't at risk of infection, clicking on the link will redirect them to a fitness app in the Apple App Store.
"This is Selfmite returning on steroids," said Denis Maslennikov, security analyst at AdaptiveMobile.
"It's more aggressive self-propagating capabilities means more victims. In addition, it uses multiple links to engage with users, increasing its monetisation potential. This additional level of complexity makes Selfmite.b a real concern for both mobile carriers and users."
