‘Daam’ On The Prowl, Targets Android Phones: CERT-In Warns Users

In its latest advisory, national cyber security agency CERT-In has warned that an Android malware called 'Daam', which infects mobile phones and hacks into sensitive data like call records, contacts, history and camera, has been found to be spreading.

The virus is also capable of "bypassing anti-virus programmes and deploying ransomware on the targeted devices", said Indian Computer Emergency Response Team (CERT-In), the technology arm of the Central government under the Ministry of Electronics and Information Technology (MeitY).

CERT-In is the government's nodal agency to deal with cyber security threats like hacking and phishing. It strengthens security-related defence of the Indian internet domain. It has said that the botnet Daam gets distributed through third-party websites or applications downloaded from untrusted/unknown sources.

"Once it is placed in the device, the malware tries to bypass the security check of the device and after a successful attempt, it attempts to steal sensitive data, and permissions such as reading history and bookmarks, killing background processing, and reading call logs, etc," the advisory said.

'Daam' is also capable of hacking phone call recordings, contacts, gaining access to camera, modifying device passwords, capturing screenshots, stealing SMSes, downloading/uploading files, etc and transmitting to the command-and-control server from the victim's device.

The malware utilises the advanced encryption standard encryption algorithm to code files in the victim's device. Other files are then deleted from the local storage, leaving only the encrypted files with ".enc" extension and a ransom note that says "readme_now.txt", the cyber security agency said.

To save oneself from such attacks, the agency said users should stay away from suspicious numbers that don't look like real mobile phone numbers, as scammers often mask their identity by using email-to-text services to avoid revealing their actual phone number.

CERT-In has also advised caution towards shortened URLs, such as those involving 'bitly' and 'tinyurl' hyperlinks like "http://bit.ly/" "nbit.ly" and "tinyurl.com/". Users are advised to hover their cursors over the shortened URLs to see the full website domain or use a URL checker, the advisory suggested.