a lawsuit against Chinese companies HeyMods, Highlight Mobi , and HeyWhatsApp, alleging that they are developing “unofficial” WhatsApp apps for Androidthat aim to steal WhatsApp accounts. The apps have reportedly been operating since May 2022.
See also: Meta: Suspends all hiring and warns of possible layoffs
Meta's complaint states that these malicious apps were available for download from the three companies' websites and from the Google Play Store, APK Pure, APKSFree, iDescargar , and Malavida.
Once installed, they use bundled malware to collect sensitive information, such as account authentication, to compromise over 1 million WhatsApp accounts.
“After victims installed the Malicious Apps, they were asked to enter their WhatsApp user credentials and authenticate their WhatsApp access to the Malicious Apps,” the complaint adds.
WhatsApp head at Meta, Will Cathcart, warned users in July not to download modified versions of WhatsApp and gave examples of the apps HeyMods and HeyWhatsApp.
See also: Make-A-Video: Meta's new AI technology that creates videos
“Recently our security team discovered hidden malware within apps, offered outside of Google Play – from a developer called ‘HeyMods’ which included ‘Hey WhatsApp’ and others,” Cathcart said.
“These apps promised new features, but they're just a scam to steal personal information stored on users' phones. We shared what we found with Google and worked with them to combat malicious apps.“
Since mid-July, Android's Google Play Protect has been updated to detect and disable malicious fake versions of WhatsApp previously downloaded to devices , after Meta notified Google of their findings.
See also: Meta: Eliminates political influence operations from China and Russia
“We are also taking enforcement action against HeyMods to stop future harm and will explore further legal options to hold HeyMods and others like them accountable,” Cathcart added.
While part of the complaint focuses on how the malicious apps were used to steal WhatsApp account information, Meta is suing the three companies for violating WhatsApp's terms of service and Meta's developer agreement
Source: Bleeping computer
