I just received this text message (screenshot), which claims to be from the national postal service, informing me that I have a package waiting for me. I have a user account on their website, so them having my cell phone number is not a surprise. But I didn't expect them to use the bit.ly service, and that triggered my first suspicion.
To be safe, I loaded the actual link (http://bit.ly/1TSvBPm) in a VM on my desktop pc. It triggers the download of an Android app (an APK file), and when I look at what that file contains I see credit card logos and other highly suspicious things. This is definitely not a real notification from the actual postal service!
I'm posting here to get the opinion of more experienced users. I'm mostly interested in hearing what I should do now:
- I already submitted this to the postal service with the request that they investigate.
- What else should I do?
- How can I avoid receiving stuff like this on my phone? Obviously somebody else than the postal service has my cell number, and knows it's an Android phone.
- I guess I will have to warn other people about this risk. I have pretty gullible relatives.
Thanks in advance for your feedback!
http://www.starsfitness.at/posta.apk
, which is probably a compromised WordPress site (though it could be a front for illegit stuff). You could report it to them and/or their hosting.