A new version of an unofficial WhatsApp Android application named ‘YoWhatsApp’ has been found stealing access keys, enabling the threat actors to control users’ accounts.
Threat analysts at Kaspersky discovered the YoWhatsApp campaign. Kaspersky says that these keys can be used in open-source utilities to connect and perform actions as the user without the actual client.
‘YoWhatsApp’ is a fully working messenger app that uses the same permissions as the standard WhatsApp app and is promoted through advertisements on popular Android applications. The app includes additional features over the regular WhatsApp, such as the ability to customize the interface or block access to chats, persuading the users to install the app.
While Kaspersky has not stated whether these stolen access keys have been abused, they can lead to account takeover, disclosure of sensitive communications with private contacts, and impersonation to close contacts.
Like the real WhatsApp Android app, the malicious app requests permissions, like accessing SMS, which is also granted to the Triada Trojan that's embedded in the app. Kaspersky says the trojan can abuse these permissions to register the victims to premium subscriptions without them realizing it and generate income for the distributors.
See What’s Next in Tech With the Fast Forward Newsletter
Tweets From @varindiamag
Nothing to see here - yet
When they Tweet, their Tweets will show up here.
