Android app offering free Netflix may steal your WhatsApp data

Over the course of two months, the FlixOnline app was downloaded approximately 500 times

Android app offering free Netflix may steal your WhatsApp data

Photo for representation only. Source: iStock.

New Delhi, April 7

Cybersecurity researchers said on Wednesday that they have discovered a fake service app on Google Play Store that offers users to view Netflix on their smartphones for free, while monitoring their WhatsApp notifications and sending automatic replies to incoming messages.

Named 'FlixOnline', the hackers distributed the malware via malicious auto-replies to incoming WhatsApp messages, using payloads received from a remote command and control (C&C) server, according to the team  from Check Point Research (CPR).

By replying to incoming WhatsApp messages, this method could enable a hacker to distribute phishing attacks, spread further malware, or spread false information or steal credentials and data from users' WhatsApp account and conversations, they warned.

"This 'wormable' Android malware features innovative and dangerous new techniques for spreading itself, and for manipulating or stealing data from trusted applications such as WhatsApp," the cybersecurity researchers said.

"It highlights that users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps, even when they appear to come from trusted contacts or messaging groups," they warned.

A threat actor could perform a wide range of malicious activities like spreading further malware via malicious links, stealing data from users' WhatsApp accounts and spreading fake or malicious messages to users' WhatsApp contacts and groups.

When the application is downloaded from the Play Store and installed, the malware starts a service that requests 'Overlay', 'Battery Optimization Ignore', and 'Notification' permissions.

If these permissions are granted, the malware then has everything it needs to start distributing its malicious payloads, and responding to incoming WhatsApp messages with auto-generated replies.

"Theoretically, though these auto-generated replies, a hacker can steal data, cause business interruptions on work related chat groups, and even extortion by sending sensitive data to all the users contacts," the team noted.

The researchers notified Google about the malicious application and the details of its research and the tech giant quickly removed the application from the Play Store.

Over the course of two months, the FlixOnline app was downloaded approximately 500 times.

"If a user was infected, they should remove the application from their device, and change their passwords," the researchers said. — IANS

Top Stories

India to open up COVID vaccination for all adults over 18 from May 1

India to open up COVID vaccination for all adults over 18 from May 1

Vaccine makers will need to reserve 50% doses for Centre and...

No evidence of the young being at greater risk in ongoing COVID wave: ICMR

No evidence of the young being at greater risk in ongoing COVID wave: ICMR

Over 70 per cent of patients above 40 years in both waves; n...

Punjab imposes stricter curbs as COVID-19 cases rise; bars, cinema halls, gyms, spas to be closed

Punjab imposes stricter curbs as COVID-19 cases rise; bars, cinema halls, gyms, spas to be closed

Ban on gatherings of over 20, including at weddings and fune...

Former PM Manmohan Singh tests positive for COVID-19; admitted to AIIMS

Former PM Manmohan Singh tests positive for COVID-19; admitted to AIIMS

88-year-old Singh and his wife had taken their second shots ...

Delhi announces 6-day lockdown starting  Monday night

Delhi announces 6-day lockdown starting Monday night

We cannot have people dying on the roads: Chief Minister Kej...

Cities

View All