Kaspersky claims over 340 000 attacks with new malicious WhatsApp mod

These attacks mainly target Arabic-speaking users

Researchers at Kaspersky recently discovered a modified version of WhatsApp that not only offers additional features but also secretly collects personal information from its victims.

Many users rely on third-party mods to enhance the functionality of their messaging apps. However, some of these mods come with hidden malware. Kaspersky has identified a new WhatsApp mod that not only adds features like scheduled messages and customizable options but also contains a malicious spyware module.

The modified WhatsApp client includes suspicious components in its manifest file that are not present in the original version. These components initiate a spy module when the phone is powered on or charging, sending device information to the attacker's server.

This data includes the victim's IMEI, phone number, country and network codes, and more. Additionally, the malware can access the victim's contacts and account details every five minutes, record audio using the microphone, and steal files from external storage.

This malware has now spread to another popular messaging app, Telegram. The malicious version of WhatsApp has spread through popular Telegram channels, with a particular focus on targeting Arabic and Azeri speakers. Some of these channels have nearly two million subscribers. Kaspersky researchers have alerted Telegram about this issue.

Azerbaijan, Saudi Arabia, Yemen, Turkey, and Egypt are the top 5 countries with the highest attack rates. Kaspersky products detect the Trojan with the following verdict Trojan-Spy.AndroidOS.CanesSpy.

To stay safe, Kaspersky experts recommend:

• Use Official Marketplaces: Download apps and software from reputable and official sources. Avoid third-party app stores, as the risk thet may host malicious or compromised apps is higher.
• Use reputable security software: Install and maintain reputable antivirus and anti-malware software on your devices. Regularly scan your devices for potential threats and keep your security software up to date. Kaspersky Premium protects its’ users from known and unknown threats.
• Educate yourself about common scams: Stay informed about the latest cyber threats, techniques, and tactics. Be cautious of unsolicited requests, suspicious offers, or urgent demands for personal or financial information.
• Third-party software from popular sources often comes with zero warranty. Keep in mind that such apps can contain malicious implants, e. g. because of supply chain attacks.