According to Bleeping Computer, a new version of an unofficial WhatsApp Android app named “YoWhatsApp” has been found to steal access keys for user accounts.
YoWhatsApp is a fully functional messenger app that uses the same permissions as the standard WhatsApp app and is promoted through ads on popular Android apps like Snaptube and Vidmate.
The app includes additional features over regular WhatsApp, such as the ability to customize the interface or block access to chats, making it tempting for users to install it. However, it has now been revealed that YoWhatsApp v2.22.11.75 grabs WhatsApp keys, allowing fraudsters to control user accounts.
Jake Moore, Global Cyber Security Consultant at ESET says:
“Fake apps have been appearing in app stores for years. And, unfortunately, it is not new to see an app that copies the original app to lure people with “extra features” that might convince users to go for it.
However, using this unofficial app can damage users' official accounts or even give fraudsters access to those accounts. Account hijacking and loss of sensitive or personal data is a worrying phenomenon as it leads to further targeted attacks.
It is strongly recommended to avoid alternative apps like this, but the youth who may be targeted by downloading these apps may not be aware of the dangers. It's even worse when they don't care about the risks, so awareness advice should be given carefully by other peers and platforms they frequent."
