Security News > 2021 > August > Custom WhatsApp Build Delivers Triada Malware

The latest version of Triada slips onto phones via an advertising software development kit used to monetize the third-party FM WhatsApp Android mobile app.

The app, only available via unofficial third-party app stores, is one of many popular WhatsApp mods that allow users to add functionality to Facebook's WhatsApp messenger.

It's unclear how popular the app is among WhatsApp users; however, a cursory review of top third-party WhatsApp mods does not list FM WhatsApp.

In 2019, Google's Android Security and Privacy Team spotlighted Triada as an example of a type of malware that would be neutralized by an update to its Google Play Protect.

"During the summer of 2017 we noticed a change in new Triada samples. Instead of rooting the device to obtain elevating privileges, Triada evolved to become a pre-installed Android framework backdoor," wrote Lukasz Siewierski, with Google's Android Security and Privacy Team.

Malware similar to Triada has garnered more attention by researchers as it has been increasingly discovered pre-installed on budget phones as a backdoor for threat actors to abuse.

News URL

https://threatpost.com/custom-whatsapp-build-malware/168892/