Malicious Android Walk and Text app discovered

Security experts are warning of a malicious Android application which harvests user information before sending out text messages to every contact in the phone's address book.

The app itself is a non-existent version 1.3.7 of the Walk and Text application created by Incorporateapps, according to Sophos principal virus researcher Vanja Svajcer.

"When the Trojan is installed, it displays the view that appears as if the legitimate Walk and Text application is being cracked," he wrote in a blog post.

"However, the users of this ‘cracked' version will be very surprised when they find out that the application does not contain any functionality related to the original. Instead, it enumerates the contacts on the device and sends an SMS to all the contacts, which incurs cost to the sender."

The Trojan also collects information such as phone number and IMEI and tries to upload the information, he explained.

The malware then displays a message which recommends the user to install the legitimate version of the app, and urges them to visit the Android Market app store.

"The question at the end is who stands behind this piece of malware? One possibility is that it was a fan of Incorporateapps applications who attempted to protect the company from piracy," wrote Svajcer.

"Another possibility is that it was somebody who wanted to damage the company's reputation so that it appears that they stand behind the attack."

The Android platform is coming under increasing scrutiny by security experts as growing numbers of the applications in its app store have been found to be infected with malware.