Triada Trojan found on WhatsApp




Kaspersky Lab experts have discovered that one of the versions of the mod for the WhatsApp messenger (FMWhatsapp16.80.0) contains the Triada Trojan.
The researchers explain that sometimes WhatsApp users lack some useful features in the official application, such as dynamic themes, self-destructing messages, hiding certain chats from the general list, automatic text translation, or the ability to see messages deleted by the interlocutor. In such cases, amateur WhatsApp builds with additional features come to the rescue.
Such builds may contain ads, which usually manifest themselves as various banners in the application. However, one of the builds of the messenger, FMWhatsapp version 16.80.0, contained the Triada Trojan, which got there along with the advertising SDK. This well-known malware can download and run other malicious modules, display ads, and purchase paid subions.
In total, in 2021, Kaspersky Lab solutions recorded more than 33,000 attacks related to WhatsApp, including under the guise of the messenger itself or mods or updates for it.

“The mod in question looks harmless to users, because it actually does what it claims to provide additional functionality. But not only advertising modules were built into it, but also a Trojan program. That's why we recommend installing apps only from official stores. Their functionality may be less extensive, but they will not bring a lot of malicious files to the device,” comments Igor Golovin, security expert at Kaspersky Lab.

Apps