heise reports that a counterfeit version of WhatsApp was downloaded roughly 500,000 times before it was addressed, and that a large number of people are now holding an app that looks right and is not. A messaging client is the worst possible app to get wrong: it holds the account, the contact graph, the message history, and the phone number that everything else uses for account recovery.
Officially, WhatsApp is distributed only through the major app stores. Anything else — a download link from a message, a search result leading to a mirror site, a package offered by a third-party store — sits outside the review process, and an app with broad notification and accessibility permissions can do essentially whatever the account can do.
For anyone who may have installed it, the order of operations matters:
Remove the app, then secure the account before restoring anything. Check WhatsApp's linked devices list for sessions that are not yours and log them out — a cloned client does not need your phone to read your messages if it registered as a companion. Enable two-step verification, which does not stop a stolen session but does block re-registration of your number elsewhere. Warn regular contacts that messages from your number may not have been yours, since the most effective follow-on attack is a request for money or a code, sent from a familiar name.
Then look at the phone. Check the app's permission list for access it should never have had, review recent purchases and unfamiliar logins, and if the build came as a sideloaded package rather than from a store, a factory reset is the conservative answer rather than an overreaction — a malicious client that was granted broad permissions may have installed more than itself.
Finally, treat the number as the real asset. Anything that uses your phone number for recovery — banking, email, social accounts — inherits the compromise. Move the accounts you can to app-based or hardware second factors, and check them for sessions you do not recognise.
The lesson is dull and worth repeating: installing an app is the granting of trust, and a familiar icon is not evidence of a familiar publisher.
