October 27, 2021 By David Bisson 2 min read

A variant of the Triada Trojan concealed itself within a WhatsApp mod for Android devices, Kaspersky found in August.

What Is Triada?

Threat actors hid Triada within the WhatsApp mod FMWhatsapp 16.80.0. The security firm also found the Trojan modification, which they named Trojan.AndroidOS.Triada.ef, gathered device IDs, MAC addresses and other unique device identifiers along with the name of the app package that deploys them.

The malware stole this information and sent it to a remote server for the purpose of registering the infected device. Once it set up this communication channel, the remote server responded with a link. The Trojan then used that link to download, decrypt and launch more files.

For instance, Triada leveraged the file Trojan-Downloader.AndroidOS.Gapac.e. This downloaded and launched other malicious modules as well as displayed full-screen ads.

The file Trojan-Downloader.AndroidOS.Helper.a arrived with similar functionality. It also used ads, only it ran them in the background to increase their views. It also downloaded and launched an installer module for xHelper, a Trojan that infected 45,000 Android devices over the span of six months back in 2019.

Meanwhile, two other files signed up the device owner for premium subscriptions. They could do this because users needed to grant FMWhatsapp permission to read their SMS text messages. Attackers used that access to confirm those premium subscriptions by providing a confirmation code received via text.

Other WhatsApp Mods Delivered Trojan Malware

Other attack campaigns involving WhatsApp made headlines in 2021.

Back in January, as an example, The Hacker News revealed that attackers were using malware to automatically respond to WhatsApp messages received from a victim’s contacts with a link to a fake Huawei mobile app. Clicking on the link caused the campaign to redirect the victim to a lookalike Google Play Store website. Once installed, the app prompted the user to grant notification access. From there, it could abuse WhatsApp and thereby spread its reach to others.

Several months later, Threatpost wrote that security researchers had spotted attackers circulating another threat via WhatsApp messages. This time, it was the FlixOnline app, which enticed WhatsApp users with a free two-month Netflix Premium subscription. The app then went about stealing a victim’s data and credentials once installed on their Android device.

Another infected mod, WhatsApp Pink, claimed to be a pink version of the official WhatsApp app. In reality, it contained a Trojan that infected a victim’s device. It spread itself to their contacts by automatically responding to their Signal, Skype and other in-app messages.

How to Defend Against Trojan Malware

The first step to avoiding threats like these is not to download unofficial modifications of apps such as WhatsApp. As discussed above, such mods can lead to premium subscriptions users don’t want or deprive them of access to their accounts altogether. There’s also the threat of malware using those mods to log into victims’ accounts and/or steal their data.

Organizations can highlight this in their security awareness training programs. Emphasize the importance of users downloading apps only from official app marketplaces, such as the Google Play Store. Discuss how activity such as pop-up ads and new credit card charges could be a sign that someone has compromised their Android device.

More from News

Recent CrowdStrike outage: What you should know

3 min read - On Friday, July 19, 2024, nearly 8.5 million Microsoft devices were affected by a faulty system update, causing a major outage of businesses and services worldwide. This equates to nearly 1% of all Microsoft systems globally and has led to significant disruptions to airlines, police departments, banks, hospitals, emergency call centers and hundreds of thousands of other private and public businesses. What caused this outage in Microsoft systems? The global outage of specific Microsoft-enabled systems and servers was isolated to…

White House mandates stricter cybersecurity for R&D institutions

2 min read - Federal cyber regulation is edging further into research and development (R&D) and higher education. A recent memo from the Office of Science and Technology Policy (OSTP) states that certain covered institutions will be required to implement cybersecurity programs for R&D security. These mandates will also apply to institutions of higher education that support R&D. Beyond strengthening the overall U.S. security posture, this move is also in direct response to growing threats posed by the People's Republic of China (PRC), as…

New memo reveals Biden’s cybersecurity priorities through fiscal year 2026

2 min read - On July 10, 2024, the White House released a new memo regarding the Biden administration’s cybersecurity investment priorities, initially proposed in July 2022. This new memorandum now marks the third time the Office of the National Cyber Director (ONCD), headed by Harry Coker, has released updated priorities and outlined procedures regarding the five core pillars of the National Cybersecurity Strategy Implementation Plan (NCSIP), now relevant through fiscal year 2026. Key highlights from the FY26 memorandum In the latest annual version…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today