Virus description of Captcha Thief

In November 2013, multiple incidents of user funds being stolen occurred, and these incidents all had a common feature: users did not receive any verification information from Alipay or the bank. After investigation, Kingsoft Antivirus Security Center found that before their funds were stolen, most of the victims had the experience of using Android phones to scan QR codes, or using Android phones to receive and install unknown apk files. There is a hidden secret in these QR codes or apk files. A new type of Trojan horse virus can intercept key information such as verification codes sent by online banking or third-party payment websites in text messages on the victim's mobile phone, and then steal online banking funds without the victim being aware of it. Kingsoft Antivirus named this type of virus “Verification Code Thief”.

According to Kingsoft Antivirus security expert Li Tiejun, after analyzing nearly 200 verification code thieves, it was found that some directly intercepted all mobile phone text messages and sent them to the hacker's phone. At this time, the victim's phone will not be able to receive any text messages; some It only intercepts text messages containing keywords such as "bank, verification code, payment". This kind of interception is more subtle. By the time the victim discovers the abnormality, the bank card balance has been robbed.

How can I lose the money in my bank card and payment account just by relying on the SMS verification code? Li Tiejun said that mobile phone text messages have actually become an important verification method for online banking payments and quick payments. Many people use mobile phone text messages to verify their identity when activating online banking functions, logging in to payment tools, and making purchases. If a Trojan horse is installed on the phone to intercept text messages, it is equivalent to handing the phone over to someone else. And the person who controls your mobile phone obtains the victim's online banking or third-party payment information through other channels. For example, when paying online with some convenient credit cards, you only need to fill in the last four digits of the card number and the verification code, "Verification Code" Trojan viruses such as "Big Thief" can easily intercept such text messages. With both an account number and a key verification code, your bank account is equivalent to an open wallet, completely exposed to others. The validity period of the SMS verification code is generally 10 minutes, which gives hackers enough time to make malicious payments.