Multiple WhatsApp knockoff applications have been discovered stealing the legitimate WhatsApp user access keys, researchers have found.
With these keys, the apps’ authors can run all kinds of malicious campaigns, including one where the victims lose their hard-earned money.
Cybersecurity researchers from Kaspersky recently discovered two messaging apps (opens in new tab) for Android, obviously targeting WhatsApp users. One is called YoWhatsApp, and the other WhatsApp Plus. Both these apps offer pretty much the same functionalities as the actual WhatsApp app, and then some. As per the report, YoWhatsApp apparently also comes with a customizable interface, and individual chat room blocks.
Stealing access keys
What users don’t see, however, is these apps stealing legitimate WhatsApp’s access keys and sending them to the knockoff’s authors, giving the attackers access to the victims’ user accounts.
According to Kaspersky, the keys can be used in open-source utilities and allow attackers to perform various actions without the user’s consent. Besides actions, the attackers can also eavesdrop on the conversations, steal identity (opens in new tab) data, and similar.
The researchers also said the attackers could use this access to subscribe the victims to premium services, charging them in the process and generating income.
The apps were being advertised via a couple of legitimate Android apps, and Kaspersky suspects the developers did not know they were being used to advertise malware. The authors have since been notified, and Kaspersky expects these distribution channels to be closed soon. Still, users that downloaded these apps will be at risk for as long as the apps are installed on their endpoints.
Popular Android apps have many knock-offs, and while not all of them are malicious, it would be best to just stay away from them, researchers suggest. These kinds of apps are rarely found on Google’s official app repository, the Play Store, and can rather be downloaded as an .APK, from third-party sources. That, alone, should be enough of a red flag, they say.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba