Widely-used WhatsApp mod stuffed with malware

FMWhatsApp is embedded with the Triada Trojan which tracks device information and intercepts texts

A widely-used modified version of WhatsApp has been Trojanised by the Triada malware, with users susceptible to having their personal information and messages intercepted.

WhatsApp variants, like the vulnerable FMWhatsApp, are often downloaded because users sometimes feel the official app lacks useful features, whether these are animated themes or self-destructing messages. 

These mods are developed by amateurs that contain ads, usually in the form of banners displayed on various screens and menus. The Triada Trojan sneaked into the FMWhatsApp 16.8.0 variant alongside its advertising software development kit (SDK), according to researchers with Kaspersky.

This might be of particular concern to businesses whose employees routinely use WhatsApp to communicate, specifically those who have opted for alternatives to the official version due to the additional functionality these variants offer. These are only available through third-party websites.

The Trojanised version that Kaspersky has identified gathers unique device identifiers, including Device IDs, Subscriber IDs, MAC addresses, as well as the name of the app package when they’re deployed. 

When the app is launched, this information is collected and sent to a remote server to register the device. It responds by sending a link to a payload, which the Trojan downloads, decrypts and launches.

At this stage, there are actually several pieces of malware that beam to a victim’s device. Trojan-Downloader.AndroidOS.Agent.ic downloads and launches other malicious modules alongside Trojan-Downloader.AndroidOS.Gapac.e, which also displays full-screen ads when users least expect it. 

Related Resource

The technology of trust

How to protect your most valuable commodity

The technology of trust- whitepaper from OktaDownload now

Trojan-Downloader.AndroidOS.Helper.a downloads and launches the xHelper Trojan installer module, and also runs invisible ads in the background to increase the number of views they get. Trojan.AndroidOS.MobOk.i then signs the device owner up for paid subscriptions, alongside the Trojan.AndroidOS.Subscriber.l module.

Finally, Trojan.AndroidOS.Whatreg.b signs in WhatsApp accounts on the victim’s phone. The malware gathers device information and sends it to the command and control (C&C) server. It responds with an address to request a confirmation code, and other information to sign in, in such a way that mimics the official WhatsApp protocol. 

“It’s worth highlighting that FMWhatsApp users grant the app permission to read their SMS messages, which means that the Trojan and all the further malicious modules it loads also gain access to them,” said Kaspersky researcher Igor Golovin.

“This allows attackers to automatically sign the victim up for premium subscriptions, even if a confirmation code is required to complete the process.

“We don’t recommend using unofficial modifications of apps, especially WhatsApp mods. You may well end up with an unwanted paid subscription, or even [lose] control of your account altogether, which attackers can hijack to use for their own purposes, such as spreading spam sent in your name.”

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

Improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021

Most Popular

Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
How to speed up Windows 11
Microsoft Windows

How to speed up Windows 11

7 Jan 2022