Danish smartphone users targeted by a smishing campaign

Earlier this week, Danish smartphone users reported a surge of malicious-looking SMS-type content that originated from a suspicious source. Researchers believe that these messages are related to the Danske Spil campaign.

The SMS informed the recipients of its enrollment in a monthly pay-to-win plan through the web. The investigation revealed that the link in the SMS redirects users to a game cracks repository well-known for pirated content aficionados and malware developers.

According to a researcher, the recent smishing campaign came from a threat actor called Dansk-game. The researcher’s initial investigation revealed that one of the users who received the message did not participate in such activities or sign up for any digital forms that made them recipients of these promotions.

 

The threat actors may have targeted the Danish smartphone users to avoid getting tracked by analysts.

 

A digital forensic investigation showed that the smishing operators targeted Danish smartphone users to reduce their digital footprint and avoid analysis. However, a more thorough investigation revealed that the HTML code in the SMS contains a scripted iframe that redirects users to a secondary domain.

The domain is popular among gamers considering the typical treasure trove of DRM busters. In addition, the domain posts explicit content; hence, it is a conspicuous dropping location for compromised payloads.

The impact of these smishing attacks is still a mystery to many individuals. However, some researchers believe that the threat actors could control the user’s end-to-end tour since the iframe is included in the attack.

For example, a user deceived by the website could be infected by spyware, leading to additional malicious actions. Some other mechanisms that the campaign could add to the infection are ransomware assemblers, trojans, keyloggers, and rootkits.

Fortunately, the campaign may yet to see an expansion soon since the actors could only target a specific group in Europe. The campaign also includes a significant flaw in their approach as the actors have a game engagement fee which could discourage users from joining.

Users should be mindful of the text messages they receive, especially those offering unwanted promotions.