Research by: Aviran Hazum, Bodgan Melnykov & Israel Wenik  

Check Point Research (CPR) recently discovered a new and innovative malicious threat on the Google Play app store which spreads itself via mobile users’ WhatsApp conversations, and can also send further malicious content via automated replies to incoming WhatsApp messages.  By replying to incoming WhatsApp messages with a payload from a command-and-control (C&C) server, this method could enable a hacker to distribute phishing attacks, spread further malware, spread false information or steal credentials and data from users’ WhatsApp accounts and conversations.

Mobile security is a top concern for every company these days - and for good reason. Over the past year, CPR researchers have observed a rise in the number of mobile-related attacks and new attack methods. From a new malware dropper found on Google Play, to an investigation unraveling the Iranian Rampant Kitten APT, the mobile threat landscape is constantly evolving.

A new wormable Android malware which spreads via WhatsApp auto-replies

As the mobile threat landscape evolves, threat actors are always seeking to develop new techniques to evolve and successfully distribute malware. In this specific campaign, Check Point’s researchers discovered a new and innovative malicious threat on the Google Play app store which spreads itself via mobile users’ WhatsApp conversations, and can also send further malicious content via automated replies to incoming WhatsApp messages. 

Researchers found the malware hidden within an app on Google Play called ’FlixOnline.’ The app is a fake service that claims to allow users to view Netflix content from all around the world on their mobiles. However, instead of allowing the mobile user to view Netflix content, the application is actually designed to monitor the user’s WhatsApp notifications, and to send automatic replies to the user’s incoming messages using content that it receives from a remote command and control (C&C) server.

The malware sends the following response to its victims, luring them with the offer of a free Netflix service: 

“Two months of Netflix premium free at no cost for REASON OF QUARANTINE (CORONA VIRUS)* Get two months of Netflix premium free anywhere in the world for 60 days. Get it now HERE https://bit[.]ly/3bDmzUw.”

Utilising this technique, a threat actor could perform a wide range of malicious activities:

• Spread further malware via malicious links
• Stealing data from users’ WhatsApp accounts
• Spreading fake or malicious messages to users’ WhatsApp contacts and groups (for example, work-related groups)

How the malware works

When the application is downloaded from the Play Store and installed, the malware starts a service that requests ‘Overlay’, ‘Battery Optimisation Ignore’, and ‘Notification’ permissions. The purpose behind obtaining these permissions is:

• Overlay allows a malicious application to create new windows on top of other applications. This is usually requested by malware to create a fake “Login” screen for other apps, with the aim of stealing victims’ credentials.
• Ignore Battery Optimisations stops the malware from being shut down by the device’s battery optimisation routine, even after it is idle for an extended period.
• The most prominent permission is the Notification access, more specifically, the Notification Listener service. Once enabled, this permission provides the malware with access to all notifications related to messages sent to the device, and the ability to automatically perform designated actions such as “dismiss” and “reply” to messages received on the device.

If these permissions are granted, the malware then has everything it needs to start distributing its malicious payloads, and responding to incoming WhatsApp messages with auto-generated replies. Theoretically, through these auto-generated replies, a hacker can steal data and cause business interruptions on work-related chat groups;  even extortion is possible by sending sensitive data to all the users contacts.

CPR responsibly notified Google about the malicious application and the details of its research, and Google quickly removed the application from the Play Store. Over the course of two months, the "FlixOnline" app was downloaded approximately 500 times.

Conclusion

This wormable Android malware features innovative and dangerous new techniques for spreading itself, and for manipulating or stealing data from trusted applications such as WhatsApp.  It highlights that users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps, even when they appear to come from trusted contacts or messaging groups.

If users have been infected, they should remove the application from their devices and change their passwords.

Tips to remain protected against mobile malware

Mobile devices present a different threat surface than traditional endpoints. Securing these devices requires following mobile-specific security best practices:

• Regular OS updates are essential. Mobile devices should always be updated to the latest version of the OS to protect against the exploitation of privilege escalation vulnerabilities.
• Only install apps from official app stores. This reduces the probability of an unintentional installation of mobile malware or a malicious application.
• Enable ‘remote wipe’ capability on all mobile devices. All devices should have remote wipe enabled to minimise the probability of loss of sensitive data.
• Install a security solution on your device.

For the full technical details of this research visit:
https://research.checkpoint.com/2021/new-wormable-and…ages-in-whatsapp/ ‎