Kaspersky Lab experts discovered that one of the versions of the mod for the WhatsApp messenger (FMWhatsapp16.80.0) contains the Triada Trojan.
Researchers explain that sometimes WhatsApp users lack some useful features in the official application, such as dynamic themes, self-destructing messages, hiding certain chats from the general list, automatically translating text, or the ability to see messages deleted by the interlocutor. In such cases, amateur WhatsApp builds with additional features come to the rescue.
Such assemblies may contain advertisements, which usually manifest themselves in the form of various banners in the application. However, in one of the messenger assemblies, FMWhatsapp version 16.80.0, there was a Triada Trojan that got there along with an ad SDK. This well-known malware can download and run other malicious modules, display ads, and purchase paid subscriptions.
In total, in 2021, Kaspersky Lab solutions recorded more than 33,000 attacks related to WhatsApp, including under the guise of the messenger itself or mods or updates for it.
“The mod in question looks harmless to users because it really does what it says – it provides additional functions. But not only adware modules were embedded in it, but also a Trojan program. This is why we recommend that you only install apps from official stores. Their functionality may be less extensive, but they will not bring a lot of malicious files with them to the device, ”comments Igor Golovin, a security expert at Kaspersky Lab.
Catch up on more stories here
Follow us on Facebook here