Triada Trojan Embedded in FMWhatsApp Enables Payload Delivery and Account Abuse

Researchers found the Android Trojan Triada embedded in the modified WhatsApp client FMWhatsApp 16.80.0 through a compromised advertising SDK. Detected as Trojan.AndroidOS.Triada.ef, the malware collects device identifiers and installed app package data, registers infected devices with a remote server, and then downloads, decrypts, and executes additional malicious components on the handset.

Observed follow-on payloads included downloaders, ad-fraud modules, premium-subscription fraud malware, and a component capable of registering a victim’s WhatsApp account on attacker-controlled infrastructure. Because users of the modded app commonly grant SMS-reading permissions, the malware can intercept verification codes, automate fraudulent premium-service signups, and support WhatsApp account takeover-related activity.