Watch Out For This Wormable Malware Spreading Via WhatsApp

3.6K

Heads up WhatsApp users! A new wormable malware campaign is in the wild that targets WhatsApp users. The malware spreads via WhatsApp supposedly to expand an adware campaign.

Malware Spreading Via WhatsApp

Security researcher Lukas Stefanko has elaborated on a new malware campaign targeting WhatsApp users.

The campaign first caught the attention of another Android security researcher with alias ReBensk who disclosed it via a tweet.

#Android #Banking #Trojan #Malware@malwrhunterteam @Spam404 @bl4ckh0l3z @JAMESWT_MHT #opendir
Huawei Mobile #Phishing Malware:https://t.co/7efeHiydOP.apps.details.settings[.pw/play/download/
"MD5: 121AB9F7C0F439274478099D9E550473"
C2: https://settings[.pw/ pic.twitter.com/ZYyMefS9kg

— Re-ind (@ReBensk) January 21, 2021

Later, Stefanko analyzed the malware and shared details via a blog post.

Briefly, the campaign targets WhatsApp users with wormable malware. Upon targeting a device, the malware then self-propagates as soon as the victim replies to anyone in WhatsApp conversations. The target would receive a message apparently from the victim user that would include a link to some Play Store app.

Tapping on the link then redirects the new target to a page that poses as a Huawei app page and mimics Google Play Store design. However, the phishing page doesn’t really belong to the Play Store.

If the target user installs the app, the malicious app then asks for permission to access device notifications. Also, it asks for permissions to continue running in the background and “draw over other apps”.

Once established, the malware then seeks messages from its C2 server every hour. The text of the message changes dynamically, but the link is always present. The spammy message then reaches other target users upon replying to a WhatsApp message notification.

The following video explains the attack scenario.

What Next?

As per Stefanko’s analysis, the malware written in Java is currently in the wild. While, for now, it appears that the malware would serve as an adware. However, it might upgrade itself in the future to become a more malicious trojan.