A million Android users have been duped by a fake version of the popular WhatsApp messaging application after a malicious version snuck into Google's official Play app store.
Reddit reader dextergenius decompiled the fake app in Google Play and found that it tries to deliver advertisements to users who have downloaded and installed it.
It was also programmed to download a second Android package, also named whatsapp.apk. This could contain arbitrary code that users had not opted to run on their devices.
The developer of the malicious app used Unicode characters at the end of the fake app's name so it wouldn't clash with the real WhatsApp.
Once installed, the fake WhatsApp tried to hide itself by not having a title and using a blank icon.
When users spotted the fake WhatsApp the developers tried to change their name as well as that of the fake app.
The fake WhatApp has been removed from the Play store by Google, but not before it was downloaded and installed a million times.
In August Google removed more than 500 apps from Play that contained the malicious Igexin software development kit that could download arbitrary plug-ins.
.png&h=140&w=231&c=1&s=0)
.png&w=100&c=1&s=0)
_page-0001.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
.png&w=120&c=1&s=0)
Tech in Gov 2025
Forrester's Technology & Innovation Summit APAC 2025
.png&w=120&c=1&s=0)
Security Exhibition & Conference 2025
Integrate Expo 2025
Digital As Usual Cybersecurity Roadshow: Brisbane edition
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
