I spy: WhatsApp clone spying on user chats in India, says report

(Image Courtesy: Meta/WhatsApp)

A threat report from ESET, the makers of NOD32 antivirus, alleges that a WhatsApp clone may be stealing data from users in India.

GB WhatsApp, a modded, unofficial version of the instant messaging platform, reads chats and spies on Indian users. The clone cannot be directly downloaded from Google's Play Store but can be acquired by jumping through a few hoops online.

There are no security checks and the app is often a minefield for spyware and other malicious software.

The report said Whatsapp owner Meta is fighting back against illegal clones by issuing a temporary ban to accounts that use them. If they continue to use the software after the initial ban, their account is permanently suspended.

India sees one of the largest numbers of Android trojans in the world. Trojans pretend to be legal software, unleashing the malicious ware once installed on a smartphone.

India is second only to China as the geolocation for Mozi, one of the biggest IoT botnets. A botnet is a network of infected computers that are controlled remotely and used to distribute malicious software without the user's knowledge.

The report says that Android threat detection jumped 9.5 percent in 2022, and the category that saw the biggest growth was spyware which was up 109 percent compared to the previous year.

"Behind the growth of spyware are mainly easy-to-access, off-the-shelf Android spyware kits available on various online forums," said Lukas Stefanko, an ESET malware researcher.

"In many cases, amateur attackers can find working and reliable remote access trojans (RATs) online for free. In comparison, the successful deployment of other types of Android malware, such as banking malware, requires at least some level of technical skill," Stefanko said.

GB WhatsApp offers features not available on the official app yet such as custom themes and the ability to revoke messages. The mod may not be the culprit but since it is not distributed officially, lax security checks allow for tampering and malware to be installed, exposing the user to data theft and spying.