The stolen conversations can be purchased from a website called WhatsAppCopy

Dec 7, 2013 09:38 GMT  ·  By

Google has removed the Balloon Pop 2 game from Google Play after learning that the application steals private WhatsApp conversations and uploads them to a website.

According to security expert Graham Cluley, the information harvested by the app is uploaded to a site called WhatsAppCopy. On this website, cybercriminals can enter the phone number of an Android device and gain access to private conversations – for a fee, or course.

On WhatsAppCopy, the Balloon Pop 2 game is advertised as a program that can be used to back up WhatsApp conversations. However, users are not clearly informed of the app’s capabilities and they’re not given the possibility to opt out.

While the shady application has been removed from Google Play, it’s likely that it’s still present on third-party marketplaces.

On the other hand, Cluley believes that this is partly WhatsApp’s fault. The company should do a better job at encrypting private conversations to make sure they cannot be stolen by such applications.

McAfee has already updated its mobile security products to detect the Balloon Pop application as a threat.