More than 1 million people downloaded a copycat WhatsApp app from the Google Play Store, according to a report from The Hacker News. The app, which is officially called Update WhatsApp Messenger, was designed to look exactly like the official WhatsApp app and was uploaded by a developer who called himself WhatsApp Inc., an overt attempt to fool even discerning users.
As to how the developer was able to get away with the name WhatsApp Inc., it appears that he “added a Unicode character space after the actual WhatsApp Inc. name,” essentially fooling unsuspecting users into believing they were downloading a legit app from the Facebook-owned property.
The app itself, as you might expect, appears to be a rudimentary chat client but its real objective is to trick users into clicking on third-party ads and coerce them into downloading presumably malicious software. One enterprising Redditor who examined the software observed:
I’ve also installed the app and decompiled it. The app itself has minimal permissions (internet access) but it’s basically an ad-loaded wrapper which has some code to download a second apk, also called “whatsapp.apk” The app also tries to hide itself by not having a title and having a blank icon.
The app has since been removed from the Google Play Store, but a snapshot of the app shows the lengths to which the developers went to fool users into thinking it was the real deal.
Google hasn’t issued an official statement on the matter, though it did tell The Register that it was looking into the matter.
