Modified WhatsApp App Caught Infecting Android Devices with Malware

An unofficial version of the popular WhatsApp messaging app
called YoWhatsApp has been observed deploying an Android
trojan known as Triada.

The goal of the malware is to steal the keys that “allow the use
of a WhatsApp account without the app^[1],” Kaspersky said^[2]
in a new report. “If the keys are stolen, a user of a malicious
WhatsApp mod can lose control over their account.”

YoWhatsApp offers the ability for users to lock chats, send
messages to unsaved numbers, and customize the app with a variety
of theming options. It’s also said to share overlaps with other
modded WhatsApp clients such as FMWhatsApp and HeyMods.

The Russian cybersecurity company said it found the malicious
functionality in YoWhatsApp version 2.22.11.75.

Typically spread through fraudulent ads on Snaptube and Vidmate,
the app, upon installation, requests the victims to grant it
permissions to access SMS messages, enabling the malware to enroll
them to paid subscriptions without their knowledge.

A successful theft of the keys can lead to a total compromise of
the account, allowing the adversary to access chat messages and
even impersonate the victim to send malspam and conduct financial
fraud.

The development comes amid Meta Platforms filing a lawsuit^[3]
against three developers in China and Taiwan for distributing
unofficial WhatsApp apps, including HeyMods, that resulted in the
compromise of over one million user accounts.

The findings also arrive a little over a year after threat
actors were found delivering the Triada malware through FMWhatsApp^[4].

“Cybercriminals are increasingly using the power of legitimate
software to distribute malicious apps,” the researchers pointed
out. “This means that users who choose popular apps and official
installation sources, may still fall victim to them.”