Once again crooks exploited the official Google’s Play Store as a repository for malicious apps. This time a fake WhatsApp version was used to infect over a million users that downloaded it.
The fake WhatsApp version program first reported by Reddit users, it appears very similar to the original one.
The following image shows on the left the fake WhatsApp, while the legit one is on the right.
The Reddit user DexterGenius has decompiled the fake WhatsApp version and discovered it is an ad-loaded wrapper which included the code to download a second apk.
“Yep, also confirmed by long-pressing the link in a browser. I’ve also installed the app and decompiled it,” reported DexterGenius.
“The app itself has minimal permissions (internet access) but it’s basically an ad-loaded wrapper which has some code to download a second apk, also called ‘whatsapp.apk.’ The app also tries to hide itself by not having a title and having a blank icon.”
The malicious app has no title and is associated with a transparent icon.
The fake app appeared to be developed by legit WhatsApp Inc, but a close look at the developer’s name revealed that authors added a hidden space at end of the name. The developer used a trick, it added two bytes, 0xC2 0xA0, at the end forming an invisible space.
It is incredible, crooks that developed this app were able to bypass the Google security controls infecting more than a million devices.
The fake WhatsApp app was removed from the official Play Store and its author is going to be banned.
Experts believe that the automated checks implemented by Google for the apps to deploy in the Play Store are still ineffective, despite the efforts of Big G.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Mobile Pwn2Own 2017, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Fintech firm Figure confirmed a data breach after hackers used social engineering to trick an…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and…
A new alleged Russia-linked APT group targeted Ukrainian defense, government, and energy groups, with CANFAIL…
A new threat actor, UAT-9921, uses the modular VoidLink framework to target technology and financial…
Attackers quickly targeted BeyondTrust flaw CVE-2026-1731 after a PoC was released, enabling unauthenticated remote code…
Google says nation-state actors used Gemini AI for reconnaissance and attack support in cyber operations.…
This website uses cookies.
