This archive report was first published on 26 August 2021.
On August 26, 2021, Kaspersky revealed a concerning discovery: a malicious version of the popular WhatsApp mod, FMWhatsapp, is spreading the Triada mobile Trojan.
The Trojan, which is downloaded by the FMWhatsapp mod, can launch ads, issue paid subscriptions, and intercept users' SMS to confirm login, leaving them vulnerable to illegal activity.
According to Kaspersky security expert Igor Golovin, "With this app, it is hard for users to recognise the potential threat because the mod application actually does what is proposed – it adds additional features. However, we have observed how cybercriminals have started to spread malicious files through the ad blocks in such apps. That is why we recommend you only use messenger software downloaded from official app stores. They may lack some additional functions, but they will not install a bunch of malware on your smartphone."
Kaspersky solutions detected the malicious implant as Trojan.AndroidOS.Triada.ef.
