2

A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I did not send. The text said "Visit http://legacy.operator.com:8080/webgui/vm[...] to read your new mms." and it appears in-line with the actual dialogue I'd had with this person.

From my phone, I see no record of sending that text. They received it around 10am, and at 11:30am I received a text from an unrecognized # with similar spam but in German. An odd coincidence or just a sign spammers were active all around. In any case, because of the difference in timing, at least the German text couldn't have infected me and caused the text to my friend.

Neither of us clicked either spam attack's link. I expect the German one I received can safely be ignored. I'm uncertain about the other text which my friend received from my # and which I have no record of sending.


Does the text my friend received from my number imply one of us has a virus? I'm concerned this is the case because either a virus on my phone sent spam out to the # I contact the most (this friend), or a virus on my friend's phone brought up spam spoofed from the # they contact the most (me). How else would the spammer know to spoof from my # to my friend's # - of all the #s it could go to/come from, my friend and I are each other's top contact.

If it does imply one of us has a virus as I suspect, is there a way to tell who, or do we each need to take antivirus cleanup measures? We both have Android phones and I think the same carrier but different phone models and OS versions. We both have antivirus on our phones (WebRoot on my end, Norton on my friend's) and scans came back clean.


Related but doesn't answer my question, just clarifies tech involved:

  • 1
    It doesn't have to be a virus. You could also be a victim of identity theft. I would recommend informing your cellphone carrier about it right away. – NH. Aug 28 '17 at 21:21
  • things like vtext.com (did) allow users to specify a "return address" number when sending a message, one that's totally un-validated. operator.com sounds like something related to that. could be a spammer or a friend using such a tool/service. could be a bug: i showed up on my friends phone as his father sometimes... – dandavis Aug 28 '17 at 23:35
5

THere are two possible scenarios: There is a virus on the sender's phone, or the SMS was spoofed, as per the SMS Spoofing link in your post. I think the most likely scenario is that there is a virus on your phone that WebRoot is not able to detect. A good way to check is to ask some of your other contacts to see if they have received a similar text. If this were a virus, I would expect your other contacts to have received similar messages.

If this was done via SMS spoofing, this implies that whoever was trying to compromise the receiver's phone knew that the two of you had a pre-existing relationship, assuming they weren't just spoofing random numbers. This would imply a targeted attack.

  • Could you also please address the possibility of the receiver having a virus, informing the attacker of the pre-existing relationship between our #s, as an one alternative explanation for the seemingly targeted spoofing attack? – cr0 Aug 29 '17 at 12:41
  • I wouldn't think it likely. If the receiver had the virus, the message would have come from that phone, not the other way around. – user52472 Aug 29 '17 at 13:23
  • Right, why would it want to reinfect itself? That makes sense, didn't think of that at first. – cr0 Aug 29 '17 at 13:57
  • If I check with my carrier and they determine that I did not send the text message, then is it safe to say I don't have a virus, or what would that mean? If they find I did send the spam message then that does strongly imply I have a virus on my phone and I'll start using a new SIM/phone – cr0 Aug 29 '17 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.