InfoSecBulletin Cybersecurity for mankind
Telegram is one of the most popular social media platforms in the world. The platform is constantly being updated. But recently cyber security experts have discovered a new malware. The malicious ‘WhatsApp Spy Mode’ has already attacked messaging platform Telegram users at least 340 thousand times.
According to the researchers, this happened throughout the month of October. A report about this terrible malware has come to light. According to cybersecurity firm Kaspersky, the malware mainly attacks people who speak Arabic, Azeri languages.
Eight New ICS Advisories released by CISA
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
Users who crave additional features from popular messaging apps often take the help of third-party apps. This is where the danger lies, the researchers explained. Third party apps offer additional features. But it also contains some malware.
While this new WhatsApp mod offers scheduled messages and customizable options, it also contains malicious spyware, they said. Victim contact and account details are sent every 5 minutes. At the same time, this spy module is also able to set up microphone recording and extract files from external storage.
The manifest file of the modified WhatsApp client contains several suspicious elements, which are not present in the original version. Whenever the receiver starts a service, the spy module is also activated when the phone is turned on or while charging. And once that spy module is activated, the malicious implant sends a request with device information to the attacker’s server. The data that is covered includes IMEI, phone number, country and network codes, among others.
However, users from Azerbaijan, Saudi Arabia, Yemen, Turkey and Egypt are the most affected. As the target is Arabic and Azerbaijani speakers, people from USA, Russia, Britain, Germany and other countries are also affected by this scam. Experts advise to be careful in using social media.
