{"id":27431,"date":"2021-08-26T12:46:08","date_gmt":"2021-08-26T09:46:08","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=27431"},"modified":"2026-03-27T23:06:57","modified_gmt":"2026-03-27T20:06:57","slug":"whasapp-malicious-code-spreads-through-a-mod-in-the-worlds-most-popular-messenger-app","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/whasapp-malicious-code-spreads-through-a-mod-in-the-worlds-most-popular-messenger-app\/","title":{"rendered":"Whasapp? Malicious code spreads through a mod in the world\u2019s most popular messenger app"},"content":{"rendered":"\n

Kaspersky has discovered a malicious version of a popular WhatsApp messenger mod (unofficial modification of the app) called FMWhatsapp. This mod spreads the Triada mobile Trojan, which downloads other Trojans and can launch ads, issue subscriptions, and intercept a user\u2019s SMSs. <\/strong><\/p>\n\n\n\n

Even though WhatsApp is one of the most popular apps for instant mobile messaging, not all users are satisfied with its features. Looking for the most user-friendly version, people can be tempted to install modified versions of WhatsApp, which provide many more options than the official one (such as choosing dynamic templates or the ability to read deleted messages). <\/p>\n\n\n\n

In such apps, creators often publish various ads to monetize their work. On the flip side, there are fraudsters taking advantage of this, often distributing malicious code through advertising. One example of this is FMWhatsapp \u2013 the 16.80.0 version \u2013 which includes the\u00a0Triada Trojan and one of the ad libraries.<\/p>\n\n\n\n

In the dangerous version of the FMWhatsapp mod, the Triada Trojan acts as a mediator. First, it collects data about the user’s mobile device and then, at the owner\u2019s command, downloads one of the other Trojans to the smartphone. These Trojans can independently launch ads, issue paid subscriptions to the device owner, and even log into the WhatsApp account, intercepting the SMS to confirm login \u2013 leaving the victim vulnerable to illegal activity through their phone.<\/p>\n\n\n\n

Downloaded by Triada, the MobOk Trojan opens a subscription page in an invisible window and clicks the \u2018Subscribe\u2019 button for the user<\/p>\n\n\n\n

\u201cWith this app, it is hard for users to recognize the potential threat because the mod application actually does what is proposed \u2013 it adds additional features. However, we have observed how cybercriminals have started to spread malicious files through the ad blocks in such apps. That is why we recommend you only use messenger software downloaded from official app stores. They may lack some additional functions, but they will not install a bunch of malware on your smartphone,\u201d <\/em>comments Igor Golovin, security expert at Kaspersky.<\/p>\n\n\n\n

Kaspersky solutions detected the malicious implant as Trojan.AndroidOS.Triada.ef. <\/p>\n\n\n\n

Learn more about the Triada Trojan in\u00a0FMWhatsapp mod on\u00a0Securelist<\/a>\u00a0and\u00a0Kaspersky Daily<\/a>.\u00a0<\/p>\n\n\n\n

To stay safe, Kaspersky experts also recommend:<\/p>\n\n\n\n