Widely-used WhatsApp mod stuffed with malware


Protect Your Access to the Internet

A widely-used modified version of WhatsApp has been Trojanised by the Triada malware, with users susceptible to having their personal information and messages intercepted.

WhatsApp variants, like the vulnerable FMWhatsApp, are often downloaded because users sometimes feel the official app lacks useful features, whether these are animated themes or self-destructing messages. 

These mods are developed by amateurs that contain ads, usually in the form of banners displayed on various screens and menus. The Triada Trojan sneaked into the FMWhatsApp 16.8.0 variant alongside its advertising software development kit (SDK), according to researchers with Kaspersky.

This might be of particular concern to businesses whose employees routinely use WhatsApp to communicate, specifically those who have opted for alternatives to the official version due to the additional functionality these variants offer. These are only available through third-party websites.

The Trojanised version that Kaspersky has identified gathers unique device identifiers, including Device IDs, Subscriber IDs, MAC addresses, as well as the name of the app package when they’re deployed. 

When the app is launched, this information is collected and sent to a remote server to register the device. It responds by sending a link to a payload, which the Trojan downloads, decrypts and launches.

At this stage, there are actually several pieces of malware that beam to a victim’s device. Trojan-Downloader.AndroidOS.Agent.ic downloads and launches other malicious modules alongside Trojan-Downloader.AndroidOS.Gapac.e, which also displays full-screen ads when users least expect it. 

Related Resource

The technology of trust

How to protect your most valuable commodity

The technology of trust- whitepaper from OktaDownload now

Trojan-Downloader.AndroidOS.Helper.a downloads and launches the xHelper Trojan installer module, and also runs invisible ads in the background to increase the number of views they get. Trojan.AndroidOS.MobOk.i then signs the device owner up for paid subscriptions, alongside the Trojan.AndroidOS.Subscriber.l module.

Finally, Trojan.AndroidOS.Whatreg.b signs in WhatsApp accounts on the victim’s phone. The malware gathers device information and sends it to the command…