sb-nz logo
Story image

New wormable Android malware discovered through auto-replies in WhatsApp

Check Point Research has discovered new malware on Google’s Play Store that could spread through WhatsApp messages. 

According to the cybersecurity firm, the malware was designed with the ability to automatically respond to incoming WhatsApp messages on behalf of its victims, and the content of the response was provided by a remote server. 

CPR found the malware hidden in a fake “Netflix” application on Play Store called FlixOnline, which promised “unlimited entertainment” from anywhere in the world.

If successful, the malware enables its threat actors to perform a range of malicious activities, such as:

  • Spread further malware via malicious links
  • Steal credentials and data from users’ WhatsApp accounts
  • Spread fake or malicious messages to users’ WhatsApp contacts and groups – for example, work-related groups

The malware was designed to be wormable, meaning it can spread from one Android device to another after the Android user clicks on the link in the message and downloads the malware. 

How the Malware Works

1.      Victim installs the malware from Google’s Play Store

2.      The malware starts to “listen” for new notifications on WhatsApp

3.      Malware responds to every WhatsApp message the victim receives with a response crafted by the threat actors

4.      In this campaign, the response was a fake Netflix site that phished for credentials and credit card information

The Scripted WhatsApp Message

The malware sent the following automatic response to its victims incoming WhatsApp messages, attempting to lure others with the offer of a free Netflix service:  

“2 Months of Netflix Premium Free at no cost For REASON OF QUARANTINE (CORONA VIRUS)* Get 2 Months of Netflix Premium Free anywhere in the world for 60 days. Get it now HERE https://bit[.]ly/3bDmzUw”.

Disguised in a Fake “Netflix” Application

CPR found the malware hidden within an application on Google Play called ’FlixOnline.’” The app turned out to be a fake service that claims to allow users to view Netflix content from around the world on their mobiles. However, instead of allowing the mobile user to view Netflix content, the application is actually designed to monitor a user’s WhatsApp notifications, sending automatic replies to a user’s incoming messages using content that it receives from a remote server.

Responsible Disclosure and Victims

CPR disclosed its findings to Google. The malicious application was subsequently taken down by Google. Over the course of two months, the "FlixOnline" app was downloaded approximately 500 times. CPR has shared its research findings with WhatsApp, though there is no vulnerability on WhatsApp’s end.

Aviran Hazum, manager of mobile intelligence at Check Point says the malware’s technique is fairly new and innovative. 

"The technique here is to hijack the connection to WhatsApp by capturing notifications, along with the ability to take predefined actions, like ‘dismiss’ or ‘reply’ via the Notification Manager," he says.

"The fact that the malware was able to be disguised so easily and ultimately bypass Play Store’s protections raises some serious red flags," Hazum explains. 

"Although we stopped one campaign of the malware, the malware family is likely here to stay. The malware may return hidden in a different app."

He says Google Play Store’s protections can only go so far. 

"Phone users need a mobile security solution. Luckily, we detected the malware early, and we quickly disclosed it to Google – who also acted quickly," Hazum says. 

"Users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps, even when they appear to come from trusted contacts or messaging groups.

"If you think you’re a victim, I would immediately remove the application from my device, and proceed to change all my passwords.”

Security Tips for Android Users

1.      Install a security solution on your device

2.     Download applications only from official markets

3.     Keep your device and apps up to date

Story image
ABB and Nozomi Networks extend collaboration, deliver improved OT security solutions
"With Nozomi Networks solutions added to our cybersecurity portfolio, our customers gain proven network monitoring and threat detection technology."More
Story image
Almost a third of malware threats previously unknown - HP report
A new report has found 29% of malware captured was previously unknown due to the widespread use of packers and obfuscation techniques by attackers seeking to evade detection. More
Story image
rhipe acquires emt Distribution, with aim to expand into enterprise market
The acquisition will enable rhipe to deliver a comprehensive portfolio of end-to-end security capabilities to its partners, the company says.More
Story image
Kroll completes Redscan acquisition, expands cyber risk portfolio
With the addition of Redscan and its extended detection and response (XDR) enabled security operations centre (SOC) platform, Kroll expands its Kroll Responder capabilities to support a wider array of cloud and on-premise telemetry sources.More
Story image
Ransomware and Microsoft Exchange attacks surging 
There are global surges in ransomware attacks alongside increases in cyber attacks targeting Microsoft Exchange Server vulnerabilities, according to Check Point Research.More
Story image
Pandemic sees organisations of all sizes and industries invest in CTI
There is opportunity for organisations to better manage their cyber-threat intelligence for greater security and threat intelligence effectiveness by adopting the right tools and processes.More