Loading story…
Researchers reported that a malicious modified version of WhatsApp was being distributed through seemingly legitimate Android applications, allowing attackers to compromise users who installed the software outside official channels. The campaign relied on repackaged apps that appeared benign but delivered a trojanized WhatsApp mod, expanding the reach of malware through trusted-looking distribution paths rather than direct phishing alone.
The activity highlights the risk posed by unofficial messaging clients and third-party app ecosystems, where attackers can hide malware inside popular software variants to steal data, abuse device access, or deploy additional payloads. The incident underscores that users and organizations should restrict installations to official app stores and vetted software sources, especially for high-use communications platforms such as WhatsApp.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky's Securelist published research describing a malicious WhatsApp modification being distributed through legitimate applications, indicating a malware distribution campaign targeting users seeking unofficial WhatsApp mods.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers found the Android Trojan **Triada** embedded in the modified WhatsApp client **FMWhatsApp 16.80.0** through a compromised advertising SDK. Detected as `Trojan.AndroidOS.Triada.ef`, the malware collects device identifiers and installed app package data, registers infected devices with a remote server, and then downloads, decrypts, and executes additional malicious components on the handset. Observed follow-on payloads included downloaders, ad-fraud modules, premium-subscription fraud malware, and a component capable of registering a victim’s WhatsApp account on attacker-controlled infrastructure. Because users of the modded app commonly grant SMS-reading permissions, the malware can intercept verification codes, automate fraudulent premium-service signups, and support WhatsApp account takeover-related activity.
Aug 14, 2026
ESET researchers uncovered dozens of fake **WhatsApp** and **Telegram** websites distributing trojanized Android and Windows installers aimed largely at Chinese-speaking users trying to access blocked messaging services outside official app stores. The malicious Android apps included the first observed **clipper** malware embedded in instant messaging clients, replacing cryptocurrency wallet addresses in chats so funds would be redirected to attacker-controlled accounts. Some samples also used **OCR** to scan screenshots and photos for wallet recovery phrases, while other variants exfiltrated messages, Telegram data, device details, and files. On Windows, the campaign delivered both Telegram clippers and bundled **remote access trojans (RATs)** that enabled keylogging, clipboard theft, screen capture, and file operations. Victims were lured through **Google Ads**, fraudulent YouTube channels, and counterfeit download pages impersonating legitimate messaging services. ESET said the operation reflects a broader cryptocurrency-theft ecosystem built around fake messaging apps and reported the malicious ads and channels to Google, which removed them.
Jul 12, 2026
A recently discovered vulnerability in WhatsApp allowed researchers to enumerate up to 3.5 billion active accounts by exploiting the app's contact syncing feature. This flaw, responsibly disclosed by researchers at the University of Vienna and subsequently patched by Meta, could have enabled malicious actors to build massive databases of phone numbers linked to WhatsApp, along with associated profile photos and "About" texts. While there is no evidence the vulnerability was exploited in the wild, the incident highlights the risks posed by convenience features and the critical importance of protecting phone numbers as sensitive personal data. In addition to this privacy risk, WhatsApp users are being targeted by a new Android malware that propagates itself through the platform. The malware automatically replies to incoming WhatsApp messages with malicious links, leveraging the trust users place in their contacts to spread further. This attack exploits the phenomenon of "context collapse," where users' social boundaries blur on messaging platforms, making them more susceptible to social engineering. These developments underscore the growing threat landscape facing WhatsApp users, combining both technical vulnerabilities and sophisticated social attacks.
Jun 29, 2026