This malware pretends to be WhatsApp, Uber and Google Play

Hackers are stealing credit card information in Europe with malware that can spoof the user interfaces of Uber, WhatsApp and Google Play.

The malware, which has struck Android users in Denmark, Italy and Germany, has been spreading through a phishing campaign over SMS (short message service), security vendor FireEye said on Tuesday.

Once downloaded, the malware will create fake user interfaces on the phone as an “overlay” on top of real apps. These interfaces ask for credit card information and then send the entered data to the hacker.

This family of malware continues to evolve. Since February, FireEye has observed 55 malicious programs in Europe that use the same overlay technique.

Earlier versions targeted banking apps, but now the malware can spoof the interfaces to more popular software, including WhatsApp and Google Play.

Users tend to input credit card information into these products as well as into banking apps, FireEye researcher Wu Zhou said in an email.

“Threat actors usually want to gain the largest financial benefit. So they typically target these apps that have a large user base,” he added.

In some cases, the malware has also targeted YouTube, Uber and Chinese messaging app WeChat.

To spread the malware, the hackers have sent off SMS messages with a link and tricked their victims into clicking on it. One SMS message said: “We could not deliver your order. Please check your shipping information here.”

Since February, FireEye has noticed that the malware has been spread through five different campaigns. In one campaign, the hackers managed to generate at least 130,000 clicks to the link where the malware was hosted.

Newer versions of the malware can also be difficult to detect. Only six out of 54 anti-virus tools tested noticed a danger with the malicious coding, according to FireEye.

The malware has been found contacting servers in the United Arab Emirates, Germany, Italy, Latvia and the Netherlands.