The app attracts victims by promising a supposed pink version of WhatsApp, but its purpose is to spread spam to your contacts.
WhatsApp is often used in various types of embezzlement. This time the promise of the so-called WhatsApp Pink has been around the app and messengers like Telegram and Signal. However, it is a bogus app that can take over some functions of the smartphone.
The spread of WhatsApp Pink was posted on Twitter by the security researcher Rajshekhar Rajaharia. According to BleepingComputer, the bogus app mainly spread among users in India. But the method used by the malware allows it to spread quickly to other regions.
WhatsApp Pink claims new victims thanks to automatic replies on messaging apps. Unbeknownst to the phone owner, the app sends a link to their contacts to download the supposed pink version of WhatsApp. Whoever opens the link takes you to a page that allows you to download the “WhatsappPink.apk” file.
Once installed, the fake application asks to access Android notifications. It is from them that it identifies the presence of new messages and sends automatic replies. After the victim gives their permission and opens the app for the first time, the icon disappears from the home screen and the system displays a warning that the app has not been installed. However, it is still stored on the phone.
After that, WhatsApp Pink starts responding to the contacts on the messengers. These are WhatsApp, WhatsApp Business, Telegram, Signal, Viber and Skype. ESET says that at this point there is no evidence that the malware performs any further action on mobile phones, but nothing prevents it from being updated to improve malicious practices.
The operation of WhatsApp Pink was demonstrated in a video by ESET:
The “#WhatsApp Pink” trojan can now auto-reply to received messages not only on WhatsApp, but also Signal, Skype, Viber and Telegram. The replies link to a malicious website further distributing the malware. #ESETresearch @LukasStefanko 1/3 pic.twitter.com/B5X0DEQTx2
– ESET research (@ESETresearch) April 19, 2021
WhatsApp Pink looks like a fake Huawei app
Lucas Stefanko, researcher at ESET, claims that WhatsApp Pink is a new version of the fake Huawei app that has been circulating since January. In this case, the malware made itself known through a fake promotion on behalf of the Chinese manufacturer. It also aimed to gain access to Android notifications and control responses on WhatsApp.
“The updated version of the Trojan not only responds to WhatsApp messages, but also to messages received in other instant messaging applications, which could explain its apparently wider distribution,” Stefanko said. According to him, this version can be a test to disseminate more dangerous fake applications.
– .
