From time to time, we are aware of a warning that malware has been found in certain Android applications, as happened at the end of January, when a researcher from the computer security company ESET discovered that malicious software was taking advantage of the rapid response functions of instant messaging apps, especially WhatsApp , by sending a link to a malicious mobile app.
At that time, the threat reached a user through a message from another person whose device had previously been infected. In that message, he was invited to install a fake Huawei app through the Google Play Store , requesting permission to send various notifications.
In this way, it took advantage of the quick response function of applications such as WhatsApp to even be able to send messages even when the mobile phone was locked, since it also requested permissions to be able to run in the background.
On this new occasion, the discovery has come from the hand of Check Point Research , who found the existence of a false application on Google Play , known by the name of “FlixOnline” , which claimed to offer users the possibility of using the Netflix streaming service from anywhere in the world.
However, instead of providing access to Netflix, what this application was actually doing was interacting with our WhatsApp account to send fake autoresponders .
How did the “FlixOnline” app really work?
Through the Google Play Store, and until originally recently, users could find an application called “FlixOnline” , which claimed to allow access to the Netflix streaming service from anywhere in the world.
Once the user downloaded and installed said application, the malware began to request “Overlay”, “Notification” and “Ignore battery optimization” permissions, with different purposes:
- Overlap. It offers the attacker the possibility of opening new windows on existing apps in order to generate fake login portals, and steal users’ access credentials with them.
- Notification. Allows attackers to view all notifications related to messages sent to the user’s device, including the ability to reply to or discard these messages. That is, it monitors notifications by sending automatic responses to incoming messages from it.
- Ignore battery optimization. It allows the attacker to keep malicious software running even after the phone is idle in order to conserve battery power.
From the moment the user grants them these permissions, the malware hides its icon so that the software cannot be easily removed. Subsequently, the malicious app hid the notification from the user so that only the user could view the message. The malware then initiates the bounce back to send the user the bogus automatic response.
And what messages was this malicious app sending? Here we discover one of the most common:
2 months of free Netflix Premium at no cost FOR QUARANTINE REASON (CORONA VIRUS) * Get 2 months of Netflix Premium free anywhere in the world for 60 days. Get it now HERE.
But not only that, since from that moment on he could have the possibility of stealing personal data , interrupting chat groups or extorting any contact on the agenda by sending sensitive data.
The experts who at the time issued the alert indicate that around 500 users had downloaded it , during the two-month period in which it remained active and available from the Play Store.
Of course, until the moment that Check Point Research informed Google, removing the malicious app from its official app store .
However, as security experts point out, the problem and risk to users’ safety may still continue, since by spreading more malware through malicious links, messages with the download link still continue to circulate on WhatsApp.
