Hackers text the French pretending to be the government. The SMS uses the original message to install the TousAntiCovid application with a link pointing to malware.
Real SMS above, fake SMS below (via)
The French are surprised to receive the government’s SMS several times. It turns out that the sending only happened once. Hackers have managed to get numbers and pretend to be a state. Your link points to a site that is visually a copy of the site for TousAntiCovid. The user will be prompted to download the app unless it is not the official version. The hacker version contains the Android.Banker malware that steals banking information. At least 19 antivirus programs discovered the deception, as can be seen on VirusTotal.
The official Twitter account for TousAntiCovid posted a tweet about fake SMS and malware. He urges the French to be very careful, especially by making sure that the association with gouv.fr ends. It also shares the official link: bonjour.tousanticovid.gouv.fr. We also learn that the SMS campaign that started a week ago ended on Wednesday.
🔴 Warning: Phishing attempt is ongoing on Android
The @gouvernementFR SMS campaign ended on Wednesday.
👉 Check the URL, it should end with https://t.co/JqY3MDKEo9
👉 Install the #TousAntiCovid application at: https://t.co/ctkqNTIb7m
– TousAntiCovid (@TousAntiCovid) December 4, 2020