14 DAY TRIAL // Cybercriminals are using WhatsApp's popularity among users to spread malware disguised as WhatsApp messages, images, audio, or video files.
With Facebook announcing over 900 million WhatsApp monthly active users, and with the application providing both mobile apps and a Web-based interface, cybercriminals have now started to take notice of its success and popularity.
Cyber-security vendor Comodo has recently detected a spam campaign that leverages a common WhatsApp theme to deliver malware to users.
According to the Comodo Antispam Labs (CASL) team, these spam emails contain malicious file attachments that spread the Nivdort malware.
Nivdort is a simple information-stealing trojan that can be used to collect information about a target computer. This data can later be uploaded to a C&C server, where criminals may decide to infect the system with another type of more dangerous malware, like banking trojans, more complex spyware, or PoS malware.
Well-crafted email subject lines are the main hook
Comodo says that, to convince users to open the spam email's attachment, the people behind this campaign use enticing subject lines, like the following: ► You have obtained a voice notification ► An audio memo was missed ► A brief audio recording has been delivered ► A short vocal recording was obtained ► A sound announcement has been received ► You have a video announcement ► A brief video note got delivered ► You’ve recently got a vocal message
“Cybercriminals are becoming more and more like marketers - trying to use creative subject lines to have unsuspecting emails be clicked and opened to spread malware,” said Fatih Orhan, Director of Technology for Comodo and the Comodo Antispam Labs.
If the target user is an avid WhatsApp user, there's a high chance that they'll open the email if it wasn't flagged as spam by their email provider.
Veteran WhatsApp users know that the service does not send email notifications, but only uses your phone's built-in notification system alone.
