Malware from Android text?

Question

Lots of questions!

I clicked a scam USPS link on my phone while half asleep. The website loaded and a small window popped up immediately and I quickly backed out of my browser but briefly saw the site - it was obviously not trying to look like usps so I'm concerned it contained a virus or malware. (I don't have the exact url but the first part was atorensa dot com)

I installed and ran AVG on the phone right away (I didn't have antivirus on it before this) and it came up blank but I factory reset it just incase. I reset all my important passwords.

I figured everything was well after I reset my phone and went about my business scanning and printing tax documents, checking my accounts etc.

Then it occurred to me that I should probably be worried that my router/modem (combo) could've been affected as the phone was on the wifi along with a secondary phone, my computer, chromebook and printer.

My router is owned by my ISP and I am not able to do firmware updates on it but I did a factory reset on it as well albeit a few hours later. My printer only allows for a "semi-full" reset - whatever that means. My computer has Kaspersky and it came up blank - then I installed and ran malwarebytes and it came up with PUP.optional.Vosternan alerts.

I checked my emails for anything suspicious and a few of them were signed into from a different IP address. Between early Mar and when the risky click happened - I had one IP address #1. Then after the risky click I reset my router etc. It showed a new IP address. I tried factory resetting the router again but it still showed IP address #2. I called my internet provider and they use dynamic IP addresses. Maybe it is a coincidence that the IP changed during this time since I wasn't able to replicate the change with another reset?

Is my phone still potentially compromised? Is there a way to scan my router/printer/chromebook for malware directly?

Thanks for any advice.

Answer 1

First of all, think about who would have the motivation to hack you. Since you 'only' visited a malicious website, hacking your phone and router would require multiple Zero-days. The use of zero-days mostly available to APTs, experienced cyber gangs (state sponsored hackers, large criminal organizations,...) and is mostly NOT used for mass exploitation, because every time you use a zero-day you increase the chance of losing your zero-day due to the fact that it could get discovered. As such, performing a full on 'hack' is not really done by sending random USPS links, this appears like a rather "regular" phishing attempt.

With dynamic IPs it is possible that you received a new IP-adress the moment you tried resetting your router. Some routers are programmed to do that or maybe the lease time ended just at that time.

I suggest using MFA where possible and the use of strong passwords/password manager. You can also check on your router dashboard if all connected devices are known to you.

Complete network enumeration is very unlikely.