A variant of the Triada Trojan concealed itself within a WhatsApp mod for Android devices, Kaspersky found in August.

What Is Triada?

Threat actors hid Triada within the WhatsApp mod FMWhatsapp 16.80.0. The security firm also found the Trojan modification, which they named Trojan.AndroidOS.Triada.ef, gathered device IDs, MAC addresses and other unique device identifiers along with the name of the app package that deploys them.

The malware stole this information and sent it to a remote server for the purpose of registering the infected device. Once it set up this communication channel, the remote server responded with a link. The Trojan then used that link to download, decrypt and launch more files.

For instance, Triada leveraged the file Trojan-Downloader.AndroidOS.Gapac.e. This downloaded and launched other malicious modules as well as displayed full-screen ads.

The file Trojan-Downloader.AndroidOS.Helper.a arrived with similar functionality. It also used ads, only it ran them in the background to increase their views. It also downloaded and launched an installer module for xHelper, a Trojan that infected 45,000 Android devices over the span of six months back in 2019.

Meanwhile, two other files signed up the device owner for premium subscriptions. They could do this because users needed to grant FMWhatsapp permission to read their SMS text messages. Attackers used that access to confirm those premium subscriptions by providing a confirmation code received via text.

Other WhatsApp Mods Delivered Trojan Malware

Other attack campaigns involving WhatsApp made headlines in 2021.

Back in January, as an example, The Hacker News revealed that attackers were using malware to automatically respond to WhatsApp messages received from a victim’s contacts with a link to a fake Huawei mobile app. Clicking on the link caused the campaign to redirect the victim to a lookalike Google Play Store website. Once installed, the app prompted the user to grant notification access. From there, it could abuse WhatsApp and thereby spread its reach to others.

Several months later, Threatpost wrote that security researchers had spotted attackers circulating another threat via WhatsApp messages. This time, it was the FlixOnline app, which enticed WhatsApp users with a free two-month Netflix Premium subscription. The app then went about stealing a victim’s data and credentials once installed on their Android device.

Another infected mod, WhatsApp Pink, claimed to be a pink version of the official WhatsApp app. In reality, it contained a Trojan that infected a victim’s device. It spread itself to their contacts by automatically responding to their Signal, Skype and other in-app messages.

How to Defend Against Trojan Malware

The first step to avoiding threats like these is not to download unofficial modifications of apps such as WhatsApp. As discussed above, such mods can lead to premium subscriptions users don’t want or deprive them of access to their accounts altogether. There’s also the threat of malware using those mods to log into victims’ accounts and/or steal their data.

Organizations can highlight this in their security awareness training programs. Emphasize the importance of users downloading apps only from official app marketplaces, such as the Google Play Store. Discuss how activity such as pop-up ads and new credit card charges could be a sign that someone has compromised their Android device.

More from News

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers. A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords…

Good Guys Decrypt Ransomware Targeting Charitable Groups

Imagine you’re an IT manager amid a ransomware attack. While your team scrambles for solutions, the intruders demand a ransom. Of course, you don’t want to pay; you just want your files back. But as time ticks by and the extortionists turn up the heat, your bosses are about to give in and pay the ransom. But then, the FBI calls. “Don’t pay,” the agent says. “We’ve found someone who can crack the encryption.” Sound too good to be true?…

Threat Groups Offer $240k Salary to Tech Jobseekers

Dark web forums are home to various individuals interested in conducting illicit or questionable activities. These forums offer opportunities such as the transaction of stolen data, Malware-as-a-Service, hacking services and invitations to collaborate in hacktivism. Cyber crime team members are recruited directly from the source: the dark web. What does this activity look like? Kaspersky recently conducted an analysis of 155 dark web forums from January 2020 to June 2022. They examined job postings and resumes that contained information about…