New Trojan Sends Spam

An ingenious new Trojan is circulating that hijacks PCs and uses them to send SMS-based spam to mobile phones.

After a PC has been infected, the Delf-HA Trojan contacts a Web site for details on which spam campaign to run and then randomly generates a series of Russian mobile numbers beginning with the prefix +7921 or +7911. It uses the "send e-mail" function of a number of Russian mobile network Web sites to actually deliver the mail sent from the infected machines.

That many of the numbers will not have been allocated to customers is of no consequence as enough real ones can be targeted randomly. The contents of the spam are believed to vary but one message shown to Techworld appeared to promote the download of MP3 music files from a named Russian Web site.

New Technique

Although Delf-HA targets only Russian mobile networks, experts have warned that the same technique could be used to send spam to subscribers of networks in other countries.

"Now SMS spammers are taking a leaf out of the book of email spammers, and using unprotected innocent PCs to pass on their unwanted messages," says Graham Cluley of antivirus vendor Sophos, which uncovered the Trojan.

Spam is not a new phenomenon on mobile phones but the volumes remain low compared to PC-based e-mail. Delf-HA could signal a depressing turning point.

To date, most of the concern has centered around the possibility of viruses such as Cabir infecting mobiles themselves. Nokia also announced in the summer that it would offer antivirus software for its 6670 smart phone.