Middle East users hit by new malicious WhatsApp mod

Kaspersky researchers discovered a new malicious version of a popular WhatsApp messenger mod dubbed YoWhatsApp. Popular for having features that the official app does not offer, this mod spreads the notorious Triada mobile Trojan, which can download other Trojans, issue paid subscriptions, and even steal WhatsApp accounts. Users around the world were affected by this threat in the last two months, and more than a quarter of them, 27% – in the META (Middle East, Turkey, Africa) region. Within the META region, 64% of users affected were from the Middle Eastern countries.

This new malicious mod is advertised in the popular Snaptube app and is also distributed via Vidmate. This makes the mod look much less suspicious to potential targets, and expands the possible number of victims. 

WhatsApp is one of the most popular messengers, used by millions of users worldwide, but not all of them are satisfied with the features offered by the legitimate application. Thus, some users prefer to download WhatsApp mods that provide far more options, such as custom backgrounds and fonts for chats, bulk messaging, or password-protected login to certain conversations. 

However, such mods are not always secure. Previously, Kaspersky had already discovered another modification of WhatsApp, which also spreads the dangerous Triada mobile Trojan.  And now, researchers have witnessed that fraudsters continue to take advantage of the popularity of the globally recognized messenger by creating new malicious modifications, such as some versions of so-called YoWhatsApp.

To infect as many users as possible, cybercriminals have resorted to a new distribution scheme. They now advertise the malicious YoWhatsApp mod in the popular Android app Snaptube, which is used to download videos from YouTube, Facebook, and Instagram. Since YoWhatsApp is being advertised in the Snaptube app used by hundreds of thousands of users around the world, many of them are not even aware that this modification could be dangerous. Most likely, even Snaptube’s developers were not aware that the attackers have decided to take advantage of legitimate advertisement mechanism in their app.

The ad in popular Snaptube app makes it look like YoWhatsApp carries no risks for users

YoWhatsApp is also being distributed via the Vidmate app. In addition to being used for downloading YouTube videos, this app contains an unofficial Android app store. Here, attackers published a malicious version of YoWhatsApp called “Whatsapp Plus”. Since Vidmate is not an official app store, the likelihood of malicious apps being distributed there increases several times over - and the appearance of Whatsapp plus, which infects users with the Triada Trojan, is an example of this.