The mobile antivirus provider warned that the new malicious apps could be a member of the Android.FakeUpdates trojan family, often used by malicious actors to infiltrate various system components, including firmware updating software, the default settings app or the component responsible for the system graphical interface. In response, the server sends a list of plugins that the trojan will download, decrypt and run,” Doctor Web explained. “To download modules, connects to one of several C&C (command-and-control) servers, sending a request with a certain array of technical data about the device.

“Among them is the interception of chats and the theft of the confidential information that could be found in them this malware can also execute spam campaigns and various scam schemes,” Doctor Web wrote.įrom a technical standpoint, the security researchers said their antivirus detected changes in two different system objects. “Moreover, instead of having one of the latest OS versions installed on them with the corresponding information displayed in the device details (for example, Android 10), they had the long outdated 4.4.2 version.”Īccording to the security researchers, the trojans target arbitrary code execution in the WhatsApp and WhatsApp Business messaging apps and could potentially be used in different attack scenarios. “These incidents are united by the fact that the attacked devices were copycats of famous brand-name models,” Doctor Web wrote. The malware, which the Doctor Web team first discovered in July 2022, was found in at least four different smartphones: ‘P48pro’, ‘radmi note 8’, ‘Note30u’ and ‘Mate40’. A team of mobile security researchers has discovered backdoors in the system partition of some budget Android device models that are counterfeit versions of known brand-name models.

Hackear whatsapp online ya