Malicious URLs pose a threat to mobile users and can be encountered in several ways like through malicious apps, websites, search results, and SMS messages. They can lead to negative consequences like information or account theft, mobile malware infection, or complete device compromise. It is important for mobile users to practice safety by only using official apps, checking app permissions, bookmarking trusted sites, and using mobile security software.

1. A DIGITAL LIFE E-GUIDE
AvoidingBadURLs
in the Mobile Web

3. Mobile malware isn’t the only thing you have to worry
about every time you use your mobile device to go online.
Cybercriminals are stepping up the production and
sophistication of their mobile threats. They’re not stopping at
just creating malicious apps and putting them where you can
easily mistake them for legitimate ones. By using bad URLs
that execute malicious routines, cybercriminals also make
browsing the web on your mobile device more dangerous.
It Doesn’t Stop at
Malicious Apps

4. Malicious URLs come in different forms:
• Malicious domains use keywords related to anything
mobile (e.g. Android, mobile, etc.). These domains host
mobile malware in the form of .APK files, which are
recognized by Android as mobile app installation files.
Sometimes these files are advertised as free versions of
paid apps, or are automatically downloaded onto your
mobile device without your knowledge.
• Malware-tied websites are linked to a mobile malware’s
malicious routines. 16.88% of all the malicious and high-
risk apps we’ve detected so far connect to bad URLs.
These URLs can vary in function. They can serve as a
repository of stolen information, host configuration files
or malware components, or host malicious ads or adware.
• Mobile phishing websites spoof legitimate login pages.
Cybercriminals trick you into giving your login details by
relying on the inability of some smartphones to display
their phony web pages completely. Mobile phishing is not
a new phenomenon by any means, but there is a rise in
its incidences. For more information, read our e-guide,
Protecting Yourself Against Mobile Phishing.
Bad URL Types

7. Even the most careful mobile user may encounter bad URLs. Here
are some example scenarios:
• App installation: Installing apps can make you susceptible
to malicious URLs. A Trojanized version of the Bad Piggies
app discovered in late 2012 makes a home screen shortcut
to the malicious app’s source website upon installation.
Opening it leads you to download even more malware onto
your device. Candy Crush, a popular puzzle game app, was
also recently targeted. Packaged as a ‘cheating’ app for the
game itself, it actually pushes ad notifications that could be
used as points of entry for malicious URLs.
• App usage: Using fake or Trojanized apps can expose you
to malicious URLs. A malicious in-app advertisement or the
app itself can link you to a malicious URL. The malicious app
we detect as ANDROIDOS_KSAPP.A automatically connects
to certain URLs in order to send and receive information.
• Online activities: Making mistakes while typing your target
website’s URL on the mobile browser’s address bar could
lead you to a spoofed web page. The 2012 holiday season
saw banks and other organizations becoming mobile
phishing targets, with pages spoofing websites such as
Paypal and Amazon. Cybercriminals can also tailor their
pages with keywords so their malicious websites will show
up in your search results.
• SMS: Receiving and reading SMS messages on your mobile
device can make you susceptible to malicious URLs. 419
scams (Nigerian scams) have long been a desktop threat,
and its mobile equivalent, SMiShing, made its debut in
2006. Cybercriminals spam you with SMS messages that
offer free items such as coupons or gifts. The spam then
points you to a URL where you can supposedly find out how
to redeem the offered items. The URL may appear to be
of a legitimate website’s, but clicking it actually leads to a
malicious web page.
How You Encounter Them

8. Becoming a victim of bad URLs can turn your mobile browsing
experience awry. Here are some of the things cybercriminals can do:
• Information theft: Cybercriminals can violate your privacy
by posting or selling your personal details, SMS or call
information, and location.
• Account security compromise: Any online account you access
with your mobile device can be compromised. Cybercriminals
can use them for malicious purposes, such as draining your
bank accounts or leaving you with unexpected bills for
products or services you didn’t even purchase.
• Mobile malware infection: Your mobile device could end
up being infected with mobile malware hosted by malicious
websites.
• Mobile device security compromise: Some mobile malware
variants can actually take complete control of your mobile
device without your knowledge. Cybercriminals can make calls
or send SMS messages without your authorization, as well
as subscribe you to premium services. These could result in
more unforeseen charges.
What Can Happen

10. Mobile web threats prove that mobile malware protection isn’t
enough to be completely safe. Here are some safety practices you
should look into:
• Use only official apps. Only download from trusted sources,
such as the developer’s website or from Google Play. This
reduces the chances of you downloading a malicious app by
mistake.
• Always check the permissions of each mobile app you
download and install. If the app is asking for your permission
to perform certain functions outside of its intended use,
uninstall it immediately. An example is a game app asking to
make calls or SMS messages in your behalf.
• Bookmark the websites you frequent. If you must use your
smartphone’s mobile browser, bookmark the sites you
frequent. This decreases the chances of you landing on a
phishing site.
• Get a mobile security solution. Powered by the Trend Micro™
Smart Protection Network™, Trend Micro Mobile Security
identifies and stops mobile threats before they reach you.
It provides a holistic approach to mobile security through
its Web Reputation Service engine, which comprehensively
classifies URLs and blocks those that are malicious.
What You Can Do
To Protect Yourself

12. Copyright ©2013 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend Micro t-ball logo are trademarks or registered trademarks of Trend
Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners.
TRENDLABS
TrendLabs is a multinational research, development,
and support center with an extensive regional
presence committed to 24 x 7 threat surveillance,
attack prevention, and timely and seamless solutions
delivery. With more than 1,000 threat experts and
support engineers deployed round-the-clock in labs
located around the globe, TrendLabs enables Trend
Micro to continuously monitor the threat landscape
across the globe; deliver real-time data to detect, to
preempt, and to eliminate threats; research on and
analyze technologies to combat new threats; respond
in real time to targeted threats; and help customers
worldwide minimize damage, reduce costs, and ensure
business continuity.
TREND MICRO
Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global
cloud security leader, creates a world safe for exchanging
digital information with its Internet content security
and threat management solutions for businesses and
consumers. A pioneer in server security with over
20 years’ experience, we deliver top-ranked client, server
and cloud-based security that fits our customers’ and
partners’ needs, stops new threats faster, and protects data
in physical, virtualized and cloud environments. Powered
by the industry-leading Trend Micro™ Smart Protection
Network™ cloud computing security infrastructure, our
products and services stop threats where they emerge—
from the Internet. They are supported by 1,000+ threat
intelligence experts around the globe.
LEGAL DISCLAIMER
The information provided herein is for general information and educational purposes only. It is not intended and should not be construed to constitute legal advice.
The information contained herein may not be applicable in all situations and may not reflect the most current situation. Nothing contained herein should be relied
or acted upon without the benefit of legal advice based upon the particular facts and circumstances presented and nothing herein should be construed otherwise.
Trend Micro reserves the right to modify the contents of this document at any time without notice.
Translations of any materials into other languages are intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise
related to the accuracy of a translation, please refer to the original language official version of the document. Any discrepancies or differences created in the
translation are not binding and have no legal effect for compliance or enforcement purposes.
Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any
kind as to its accuracy, currency or completeness. You agree that access to and use of and reliance upon this document and the content thereof is at your own risk.
Trend Micro disclaims all warranties of any kind, express or implied. Neither Trend Micro nor any party involved in creating, producing or delivering this document
shall be liable for any consequences, losses, or damages, including direct, indirect, special, consequential, loss of business profits or special damages, whatsoever
arising out of access to, use of or inability to use, or in connection with the use of this document, or any errors or omissions in the content thereof. Use of this
information constitutes acceptance for use in an “as is” condition.