A widely-used modified version of WhatsApp has been Trojanised by the Triada malware, with users susceptible to having their personal information and messages intercepted.
WhatsApp variants, like the vulnerable FMWhatsApp, are often downloaded because users sometimes feel the official app lacks useful features, whether these are animated themes or self-destructing messages.
These mods are developed by amateurs that contain ads, usually in the form of banners displayed on various screens and menus. The Triada Trojan sneaked into the FMWhatsApp 16.8.0 variant alongside its advertising software development kit (SDK), according to researchers with Kaspersky.
This might be of particular concern to businesses whose employees routinely use WhatsApp to communicate, specifically those who have opted for alternatives to the official version due to the additional functionality these variants offer. These are only available through third-party websites.
The Trojanised version that Kaspersky has identified gathers unique device identifiers, including Device IDs, Subscriber IDs, MAC addresses, as well as the name of the app package when they’re deployed.
When the app is launched, this information is collected and sent to a remote server to register the device. It responds by sending a link to a payload, which the Trojan downloads, decrypts and launches.
At this stage, there are actually several pieces of malware that beam to a victim’s device. Trojan-Downloader.AndroidOS.Agent.ic downloads and launches other malicious modules alongside Trojan-Downloader.AndroidOS.Gapac.e, which also displays full-screen ads when users least expect it.
Trojan-Downloader.AndroidOS.Helper.a downloads and launches the xHelper Trojan installer module, and also runs invisible ads in the background to increase the number of views they get. Trojan.AndroidOS.MobOk.i then signs the device owner up for paid subscriptions, alongside the Trojan.AndroidOS.Subscriber.l module.
Finally, Trojan.AndroidOS.Whatreg.b signs in WhatsApp accounts on the victim’s phone. The malware gathers device information and sends it to the command and control (C&C) server. It responds with an address to request a confirmation code, and other information to sign in, in such a way that mimics the official WhatsApp protocol.
“It’s worth highlighting that FMWhatsApp users grant the app permission to read their SMS messages, which means that the Trojan and all the further malicious modules it loads also gain access to them,” said Kaspersky researcher Igor Golovin.
“This allows attackers to automatically sign the victim up for premium subscriptions, even if a confirmation code is required to complete the process.
“We don’t recommend using unofficial modifications of apps, especially WhatsApp mods. You may well end up with an unwanted paid subscription, or even [lose] control of your account altogether, which attackers can hijack to use for their own purposes, such as spreading spam sent in your name.”
