InfoSecBulletin Cybersecurity for mankind
Telegram is one of the most popular social media platforms in the world. The platform is constantly being updated. But recently cyber security experts have discovered a new malware. The malicious ‘WhatsApp Spy Mode’ has already attacked messaging platform Telegram users at least 340 thousand times.
According to the researchers, this happened throughout the month of October. A report about this terrible malware has come to light. According to cybersecurity firm Kaspersky, the malware mainly attacks people who speak Arabic, Azeri languages.
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Users who crave additional features from popular messaging apps often take the help of third-party apps. This is where the danger lies, the researchers explained. Third party apps offer additional features. But it also contains some malware.
While this new WhatsApp mod offers scheduled messages and customizable options, it also contains malicious spyware, they said. Victim contact and account details are sent every 5 minutes. At the same time, this spy module is also able to set up microphone recording and extract files from external storage.
The manifest file of the modified WhatsApp client contains several suspicious elements, which are not present in the original version. Whenever the receiver starts a service, the spy module is also activated when the phone is turned on or while charging. And once that spy module is activated, the malicious implant sends a request with device information to the attacker’s server. The data that is covered includes IMEI, phone number, country and network codes, among others.
However, users from Azerbaijan, Saudi Arabia, Yemen, Turkey and Egypt are the most affected. As the target is Arabic and Azerbaijani speakers, people from USA, Russia, Britain, Germany and other countries are also affected by this scam. Experts advise to be careful in using social media.
