Hackers have developed malware capable of outwitting the Captcha recognition systems used to weed out fraudulent traffic, according to the security vendor Kaspersky Lab.
Images put before the text message trojan Podec are automatically forwarded onto image-to-text recognition service Antigate, which converts the image to text, ultimately allowing the virus to subscribe Android victims to premium rate services.
Victor Chebyshev, non-intel research group manager at Kaspersky, said: "Podec marks a new and dangerous phase in the evolution of mobile malware. It is devious and sophisticated.
"The social engineering tools used in its distribution, the commercial-grade protector used to conceal the malicious code and the complicated process of extortion achieved by passing the Captcha test all lead us to suspect that this Trojan is being developed by a team of Android developers specialising in fraud and illegal monetisation."
Those behind Podec have even been able to bypass the Advice on Charge check which requires users to authorise payment to premium services, and have used various means to hide the source code, making it difficult to analyse.
At present the virus is mostly hitting Russian Android users through VKontakte (VK), a popular social network in the country, as well as other obscure domain names, though Kaspersky reports its creators have future ambitions.
"It is clear that Podec is being further developed, possibly with new targets and goals in mind, and we urge users to be wary of links and offers that sound too good to be true," Chebyshev said.
