Download PDF version Contact company

Check Point Research (CPR) discovered new malware on Google’s Play Store that spreads via WhatsApp messages.  The malware is designed to automatically respond to incoming WhatsApp messages on the victim’s device, using content that the malware downloads from a remote server.

Hidden in fake Netflix app

CPR found the malware hidden in a fake Netflix application on the Play Store called FlixOnline, which promised unlimited entertainment from anywhere in the world.

If successful, the malware enables its threat actors to perform a range of malicious activities, such as spreading additional malware via malicious links, stealing credentials and data from users' WhatsApp accounts, and spreading fake or malicious messages to users. WhatsApp contacts and groups, for example, work-related groups.

Malware spreading through link 

The malware was designed to be wormable, meaning it can spread from one Android device to another after a user clicks on the malicious link in the message and downloads the malware. It works like this:    

  • Victim installs the fake FlixOnline app from Google’s Play Store which contains the malware
  • The malware changes permissions on the user’s device to enable automatic responses to new notifications on WhatsApp
  • The malware responds to every WhatsApp message the victim receives with an automatic reply crafted by the threat actors
  • In this campaign, the response was a fake Netflix site that phished for users credentials and credit card information

Automated response

The malware sent the following automatic response to its victims incoming WhatsApp messages, attempting to lure others with the offer of a free Netflix service: 2 Months of Netflix Premium Free at no cost For REASON OF QUARANTINE (CORONA VIRUS)* Get 2 Months of Netflix Premium Free anywhere in the world for 60 days. 

Fake service within the application

CPR found the malware hidden within an application on Google Play called FlixOnline

CPR found the malware hidden within an application on Google Play called FlixOnline. The app turned out to be a fake service that claimed to allow users to view Netflix content from around the world on their mobiles.

However, instead of allowing the mobile user to view Netflix content, the application is actually designed to monitor a user’s WhatsApp notifications, sending automatic replies to a user’s incoming messages using content that it receives from a remote server.

Innovative hijack technique 

Aviran Hazum, Manager of Mobile Intelligence at Check Point Software said, “The malware’s technique is new and innovative, aiming to hijack users. Whatsapp account by capturing notifications, along with the ability to take predefined actions, like dismiss or reply via the Notification Manager.”

“The fact that the malware was able to be disguised so easily and ultimately bypass Play Store’s protections raises some serious red flags. Although we stopped one campaign using this malware, the malware may return hidden in a different app.”

Mobile security solution

Users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps

The Play Store’s protections can only go so far, so mobile users need a mobile security solution. Luckily, we detected the malware early, and we quickly disclosed it to Google who also acted quickly.

Users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps, even when they appear to come from trusted contacts or messaging groups. If you think you’re a victim, we recommend immediately removing the application from devices and changing all passwords.

App taken down by Google

CPR responsibly disclosed its findings to Google. The malicious application was subsequently taken down by Google. Over the course of two months, the FlixOnline app was downloaded approximately 500 times. CPR has shared its research findings with WhatsApp, though there is no vulnerability on WhatsApp’s end.

 Security Tips for Android Users

  • Install a security solution on your device
  • Download applications only from official markets
  • Keep your device and apps up to date
Download PDF version Download PDF version

In case you missed it

How did security change for the better in 2024?
How did security change for the better in 2024?

2024 was a year of significant challenges and remarkable progress in a world that is more interconnected than ever. Global collaboration continues to point the way toward continuin...

Keyless security with ASSA ABLOY at Helsinki Airport
Keyless security with ASSA ABLOY at Helsinki Airport

Managing access to and around Helsinki Airport is a complex task. Around 15,000 people work there daily pre-pandemic passenger numbers hovered around 60,000 to 70,000. Challenges...

Heathrow Airport transforms security with Genetec solutions
Heathrow Airport transforms security with Genetec solutions

Genetec Inc., a pioneering technology provider of unified security, public safety, operations, and business intelligence solutions, announced that Heathrow Airport’s multi-ye...

Quick poll
Which AI-powered capability will dominate in the years ahead?