InfoSecBulletin Cybersecurity for mankind
Telegram is one of the most popular social media platforms in the world. The platform is constantly being updated. But recently cyber security experts have discovered a new malware. The malicious ‘WhatsApp Spy Mode’ has already attacked messaging platform Telegram users at least 340 thousand times.
According to the researchers, this happened throughout the month of October. A report about this terrible malware has come to light. According to cybersecurity firm Kaspersky, the malware mainly attacks people who speak Arabic, Azeri languages.
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
Users who crave additional features from popular messaging apps often take the help of third-party apps. This is where the danger lies, the researchers explained. Third party apps offer additional features. But it also contains some malware.
While this new WhatsApp mod offers scheduled messages and customizable options, it also contains malicious spyware, they said. Victim contact and account details are sent every 5 minutes. At the same time, this spy module is also able to set up microphone recording and extract files from external storage.
The manifest file of the modified WhatsApp client contains several suspicious elements, which are not present in the original version. Whenever the receiver starts a service, the spy module is also activated when the phone is turned on or while charging. And once that spy module is activated, the malicious implant sends a request with device information to the attacker’s server. The data that is covered includes IMEI, phone number, country and network codes, among others.
However, users from Azerbaijan, Saudi Arabia, Yemen, Turkey and Egypt are the most affected. As the target is Arabic and Azerbaijani speakers, people from USA, Russia, Britain, Germany and other countries are also affected by this scam. Experts advise to be careful in using social media.
