This malware hides in fake WhatsApp and Telegram apps so you can recognize it

Hackers are aware of the applications that most users usually download on their mobile phones, including social networks and messaging applications, and therefore they try to use many of the known applications to install their malware.

And that’s what the new malware was called drakari which is able to automatically click and grant certain permissions without the user’s consent and distribute it in fake Telegram, WhatsApp, YouTube and Signal apps to make it easier to fool users.

In order to obtain certain permissions, the malware requests access to accessibility services, which can lead to an automatic click on the screen interface and gain access to many other functions of our mobile phone.

When a user’s terminal is infected, they can access call logs, contacts, files, text messages, geolocation, device information, take pictures, turn on the microphone, and install other malicious apps, as Meta points out, through bleepingcomputer.

According to Meta, this is malware because of its infrastructure “was not detected by existing anti-virus systems‘, so it may go unnoticed.

One way these well-known applications, but with malicious code, are distributed is through the use of phishing pages that resemble the official download portals for these applications.

And this happens especially with Signalsince its source code is available to the public, so the hackers created a version of the app with all the usual features but with malicious code in their code.

Once the malicious app is installed, it requests access to a series of permissions that users accept, most of which do not read what they are actually granting on their phone.

In addition to the above, the researchers found that malware take screenshots, record sound and upload media files to a server controlled by hackers.