Once again crooks exploited the official Google’s Play Store as a repository for malicious apps. This time a fake WhatsApp version was used to infect over a million users that downloaded it.
The fake WhatsApp version program first reported by Reddit users, it appears very similar to the original one.
The following image shows on the left the fake WhatsApp, while the legit one is on the right.
The Reddit user DexterGenius has decompiled the fake WhatsApp version and discovered it is an ad-loaded wrapper which included the code to download a second apk.
“The app itself has minimal permissions (internet access) but it’s basically an ad-loaded wrapper which has some code to download a second apk, also called ‘whatsapp.apk.’ The app also tries to hide itself by not having a title and having a blank icon.”
The malicious app has no title and is associated with a transparent icon.
The fake app appeared to be developed by legit WhatsApp Inc, but a close look at the developer’s name revealed that authors added a hidden space at end of the name. The developer used a trick, it added two bytes, 0xC2 0xA0, at the end forming an invisible space.
It is incredible, crooks that developed this app were able to bypass the Google security controls infecting more than a million devices.
The fake WhatsApp app was removed from the official Play Store and its author is going to be banned.
Experts believe that the automated checks implemented by Google for the apps to deploy in the Play Store are still ineffective, despite the efforts of Big G.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.