Android users have been targeted by a malicious program that tricks them into downloading a fake application that also targets friends' devices via WhatsApp.
The malicious program cannot infect an individual's phone unless he receives the message himself and clicks on the link that contains it.
Then the user is required to activate a variety of functions and permissions, and these activate a hidden ability which means that when the phone receives a WhatsApp message, it will immediately respond with a link to a malicious site.
The scam is intended to bomb people with ads that generate revenue for criminals, or trick people into signing up for a subscription service.
However, the software can also easily be changed to become more sinister, such as stealing personal information as well as banking details, experts warn.
An automatic message is sent once every hour to avoid appearing to be spam, and includes "application download" information. If someone clicks on the link, they will find a site that appears as a disguised copy of the Google Play Store, but it is actually fake. .
The message asks the user to download an application called Huawei Mobile, which is not a real Huawei application, rather it was created by hackers (social networking sites).
The person is asked to download an application called Huawei Mobile, and this is not a real Huawei application but rather created by hackers.
A WhatsApp spokesperson told MailOnline, "This is a malicious application that tricks people into downloading it and sending phishing messages through the permissions granted by the Android operating system. We are reporting this to provide the domain that the phishing service uses to take action and protect against it." This abuse, and we strongly encourage people not to install applications from unreliable sources and not to click on unusual or suspicious links. We also encourage users to report such messages as quickly as possible so that we can take action. "
Lucas Stefanco, a researcher at the cybersecurity company ESET, discovered the flaw and posted a video showing how it works on YouTube.
Ray Walsh, technology expert at ProPrivacy, says the scam has the potential to steal personal information and credentials.
"It seems that the primary goal of the malicious program is to deceive the victims into falling into a fraud by participating in ad programs, which leads to deceiving the victim," he added.
Jake Moore, ESET's cybersecurity specialist, encourages people to be careful and vigilant when sending links on any platform they do not recognize or appear unusual.
People should be very careful when receiving any link, especially when the link is what appears to be an app store.
Although it only works on certain phones, this malicious program has the ability to steal bank passwords or completely encrypt the phone which could lead to more damage.