WhatsApp, Facebook Messenger Users Targeted by WolfRAT Android Malware: Cisco Researchers


Messaging apps users are being tricked into installing a trojan on their Android phones that spies on them by collecting photos, videos, messages, and recording audio. The researchers at Cisco Talos are calling it “WolfRAT”. It targets users of Whatsapp, Facebook Messenger, and Line in the guise of a Google Play or Flash update and gets them to install the trojan on their phones after which it not only collects different types of data but also sends them to the trojan command and control (C2) servers.

Researchers said that WolfRAT, a Remote Access Trojan (RAT), is a modified version of DenDroid, an older malware. DenDroid’s source code was leaked in 2015 and since then, other malware like WolfRAT have come out to attack unsuspecting users. Messaging apps are especially on their radar. The trojan was seen recording the screen when WhatsApp Messenger was being run.

According to researchers, Thai users are being targeted by WolfRAT. Some of the C2 servers are also based in Thailand itself. The C2 server domain names contain Thai food names as well. Moreover, Thai comments were also found on the C2 framework.

The researchers claim the WolfRAT is very likely being run by Wolf Research, an organisation that used to create interception and espionage-based malware. While the organisation may not be formally active, its members are likely to be functioning. This trojan is also possibly performing the role of “an intelligence-gathering tool”.

Additionally, the researchers found that work on the trojan was done in a lazy manner. There was a lot of copy/paste from public sources, dead code, unstable code, and open panels etc. However, it was also added by them that the ability to gather data from phones is a big win for the operator because people send a lot of sensitive information via messages and are mostly unafraid about their privacy and security.

For the latest tech news and reviews, follow Gadgets 360 on Twitter, Facebook, and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel.

Prabhakar Thakur
A news junkie and politics buff, he now talks tech. He misses the days when he used to play NFS Most Wanted and Counter-Strike non-stop with his school friends.

Microsoft Warns of Massive COVID-19 Themed Phishing Campaign That Lets Attackers Gain Remote Access

Your Devices May Be Vulnerable to BIAS Bluetooth Attack: Report

Articles You May Like

Kevin Alejandro Says Manny’s ‘Searching for Where He Belongs’ With Job Change
Book Riot’s YA Book Deals of the Day for February 24, 2024
Henry Cavill Rumored for ‘Key’ Marvel Role
Every Slayer Song Ranked From Worst to Best
Book Riot’s Deals of the Day for February 20, 2024