A number of websites set up to deliver Trojan horse versions of the WhatsApp and Telegram apps have been observed targeting Android and Windows users.
As ESET security researchers have discovered, most of these apps rely on clipper malware designed to steal or modify the contents of the Android clipboard.
You can read more about clipper malware here: Shein app accesses clipboard data on Android devices
“They all target victims’ cryptocurrency funds, and some target cryptocurrency wallets. ESET malware researchers Lukas Stefanko and Peter Strýček wrote in an advisory on Thursday.
“Additionally, some clippers abused OCR. [optical character recognition] This is the first time we’ve seen the exploit of screen reader technology extracting mnemonic phrases from images stored on the victim’s device. ”
Cybersecurity researchers also said they found a Windows version of the wallet-switching clipper, along with Telegram and WhatsApp installers for Windows packed with remote access Trojans (RATs).
“A RAT, through various modules, gives an attacker control over a victim’s machine.”
From a technical point of view, Stefanko and Strýček explained that trojanizing Telegram is a relatively easy task for attackers because the app’s code is open source.
“On the other hand, WhatsApp’s source code is not publicly available, which means that before repackaging the application with malicious code, attackers can first analyze the functionality of the app in detail to identify specific places to change. We had to identify the .” read the ESET advisory.
Regarding victims, malware researchers say the trojanized versions of the WhatsApp and Telegram apps primarily target Chinese-speaking users.
“Because both Telegram and WhatsApp have been blocked in China for several years. […] Those who want to use these services must resort to indirect means to obtain them,” write Stefanko and Stricek. “Naturally, this is a golden opportunity for cybercriminals to exploit the situation.”
Another malware campaign aimed at stealing cryptocurrencies was recently spotted by Proofpoint.
