WhatsApp, Facebook Messenger users targeted by WolfRAT Android Malware

Security researchers at Cisco Talos have discovered malware, dubbed as WolfRAT that is targeting WhatsApp and Facebook Messenger, app users in Thailand on the Android operating system

Users are being tricked into installing a trojan on their Android phones that spies on them by collecting photos, videos, messages, and recording audio

Researchers said that WolfRAT, a Remote Access Trojan (RAT), is a modified version of DenDroid, an older malware. DenDroid’s source code was leaked in 2015. Since then, other malware like WolfRAT has come out to attack unsuspecting users. The trojan was seen recording the screen when WhatsApp Messenger was being run.

Messenger apps, in particular, are targeted, due to content exfiltrating functions alongside the theft of browser histories. When WhatsApp is in use, for example, the malware launches a screen recorder function at 50-second intervals which will only stop when the app is closed.

Sources claim WolfRAT is very likely to be run by Wolf Research, an organization that used to create interception and espionage-based malware. While the organization may not be formally active, its members are likely to be functioning.