Banks in Singapore reports malware attacking its customers through WhatsApp

A report by the Singapore Straits Times reveals that there is malware lurking within WhatsApp‘s update that can affect Android devices. According to the Association of Banks in Singapore (ABS), this update was not initiated by the app maker and has been infecting Android devices in Singapore over the past few months.

After the “update” has been downloaded, the malware will prompt the user to enter confidential information, such as credit card details. Then the malware would take over the affected device and intercepts the one-time password (OTP) sent via SMS to the phone for committing fraudulent transactions.

“Criminals have been targeting computer users, but now criminals have turned to targeting Android phone users as banks are pushing out more banking apps for user convenience,” said ABS director Ong-Ang Ai Boon. It turns out convenience really is becoming the downfall of humanity as we continuously rely on our devices to carry out daily activities.

According to Channel NewsAsia, this vulnerability extends beyond just WhatsApp as they claim the malware is disguising itself as an operating system update as well. They reported that about 50 smartphone users have been hit by malware targeting mobile banking customers in the last three months. Besides disguising itself as a WhatsApp update, it also reportedly masquerades as an operating system update for the battery management module.

Channel NewsAsia also reports that ABS estimates the average amounts lost by the victims who are customers of major retail banks in Singapore were “a couple of hundred of dollars”, although some victims could have lost several thousand dollars through multiple transactions. The source of these fraudulent transactions appear to originate from Eastern Europe and includes purchases of budget airline tickets.

“Jailbroken iPhones or rooted Android [devices] are vulnerable…and in particular Android, because that phone system involves easier download of third-party apps,” said Ong-Ang. The silver lining is that ABS states that banks may refund victims on a case-by-case basis depending on whether or not the victim took the necessary precautions to protect themselves from such attacks.

Singapore is awfully close to our home soil of Malaysia, so please be warned and double check your updates before installing them. At the time that this article was written, there has been no official announcement on this matter posted on WhatsApp’s Facebook page, Twitter or Blog. So the moral of the story here is, please make sure that your application updates come directly from the Google Play Store.

[SOURCE, 2]