New android malware disguised as Netflix app spreads via WhatsApp message auto-replies

Check Point Research (CPR) discovered new malware on Google’s Play Store that spreads via WhatsApp messages. The malware is designed to automatically respond to incoming WhatsApp messages on the victim’s device, using content that the malware downloads from a remote server.

Hidden in fake Netflix app

CPR found the malware hidden in a fake Netflix application on the Play Store called FlixOnline, which promised unlimited entertainment from anywhere in the world.

If successful, the malware enables its threat actors to perform a range of malicious activities, such as spreading additional malware via malicious links, stealing credentials and data from users' WhatsApp accounts, and spreading fake or malicious messages to users. WhatsApp contacts and groups, for example, work-related groups.

Malware spreading through link

The malware was designed to be wormable, meaning it can spread from one Android device to another after a user clicks on the malicious link in the message and downloads the malware. It works like this:

Victim installs the fake FlixOnline app from Google’s Play Store which contains the malware
The malware changes permissions on the user’s device to enable automatic responses to new notifications on WhatsApp
The malware responds to every WhatsApp message the victim receives with an automatic reply crafted by the threat actors
In this campaign, the response was a fake Netflix site that phished for users credentials and credit card information

Automated response

The malware sent the following automatic response to its victims incoming WhatsApp messages, attempting to lure others with the offer of a free Netflix service: 2 Months of Netflix Premium Free at no cost For REASON OF QUARANTINE (CORONA VIRUS)* Get 2 Months of Netflix Premium Free anywhere in the world for 60 days.

Fake service within the application

CPR found the malware hidden within an application on Google Play called FlixOnline

CPR found the malware hidden within an application on Google Play called FlixOnline. The app turned out to be a fake service that claimed to allow users to view Netflix content from around the world on their mobiles.

However, instead of allowing the mobile user to view Netflix content, the application is actually designed to monitor a user’s WhatsApp notifications, sending automatic replies to a user’s incoming messages using content that it receives from a remote server.

Innovative hijack technique

Aviran Hazum, Manager of Mobile Intelligence at Check Point Software said, “The malware’s technique is new and innovative, aiming to hijack users. Whatsapp account by capturing notifications, along with the ability to take predefined actions, like dismiss or reply via the Notification Manager.”

“The fact that the malware was able to be disguised so easily and ultimately bypass Play Store’s protections raises some serious red flags. Although we stopped one campaign using this malware, the malware may return hidden in a different app.”

Mobile security solution

Users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps

The Play Store’s protections can only go so far, so mobile users need a mobile security solution. Luckily, we detected the malware early, and we quickly disclosed it to Google who also acted quickly.

Users should be wary of download links or attachments that they receive via WhatsApp or other messaging apps, even when they appear to come from trusted contacts or messaging groups. If you think you’re a victim, we recommend immediately removing the application from devices and changing all passwords.

App taken down by Google

CPR responsibly disclosed its findings to Google. The malicious application was subsequently taken down by Google. Over the course of two months, the FlixOnline app was downloaded approximately 500 times. CPR has shared its research findings with WhatsApp, though there is no vulnerability on WhatsApp’s end.

Security Tips for Android Users