A million Android users have been duped by a fake version of the popular WhatsApp messaging application after a malicious version snuck into Google's official Play app store.
Reddit reader dextergenius decompiled the fake app in Google Play and found that it tries to deliver advertisements to users who have downloaded and installed it.
It was also programmed to download a second Android package, also named whatsapp.apk. This could contain arbitrary code that users had not opted to run on their devices.
The developer of the malicious app used Unicode characters at the end of the fake app's name so it wouldn't clash with the real WhatsApp.
Once installed, the fake WhatsApp tried to hide itself by not having a title and using a blank icon.
When users spotted the fake WhatsApp the developers tried to change their name as well as that of the fake app.
The fake WhatApp has been removed from the Play store by Google, but not before it was downloaded and installed a million times.
In August Google removed more than 500 apps from Play that contained the malicious Igexin software development kit that could download arbitrary plug-ins.
.png&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
RIMPA Live Convention 2026
What’s Next?
iTnews Benchmark Security Awards 2026
iTnews State of Security Breakfast Sydney
iTnews Executive Retreat - Security Leaders Edition - VIC
.jpg&h=140&w=231&c=1&s=0)
.jpg&h=140&w=231&c=1&s=0)
.png&h=140&w=231&c=1&s=0)
