{"id":316063,"date":"2025-11-29T08:17:04","date_gmt":"2025-11-29T08:17:04","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/316063\/"},"modified":"2025-11-29T08:17:04","modified_gmt":"2025-11-29T08:17:04","slug":"if-you-get-this-whatsapp-message-your-phone-is-being-hacked","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/316063\/","title":{"rendered":"If You Get This WhatsApp Message, Your Phone Is Being Hacked"},"content":{"rendered":"<p><img decoding=\"async\" class=\" top-image\" src=\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/11\/1764404224_786_0x0.jpg\" alt=\"WhatsApp app\" data-height=\"1234\" data-width=\"1852\" fetchpriority=\"high\" style=\"position:absolute;top:0\"\/><\/p>\n<p>Delete this message immediately. <\/p>\n<p>AFP via Getty Images<\/p>\n<p>This warning is very simple. Android users are now <a class=\"color-link\" href=\"https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/10\/25\/unprotected-1-billion-iphone-and-android-users-must-act-now\/\" data-ga-track=\"InternalLink:https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/10\/25\/unprotected-1-billion-iphone-and-android-users-must-act-now\/\" target=\"_self\" aria-label=\"under attack\" rel=\"nofollow noopener\">under attack<\/a> from dangerous new malware that will steal crypto and steal banking credentials to empty accounts. The threat is delivered by a WhatsApp message \u2014 if you see it, you delete it. Period.<\/p>\n<p>The warning comes courtesy of <a class=\"color-link\" href=\"https:\/\/www.cleafy.com\/cleafy-labs\/albiriox-rat-mobile-malware-targeting-global-finance-and-crypto-wallets\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-ga-track=\"ExternalLink:https:\/\/www.cleafy.com\/cleafy-labs\/albiriox-rat-mobile-malware-targeting-global-finance-and-crypto-wallets\" aria-label=\"Cleafy\">Cleafy<\/a>, which has \u201cidentified and analyzed Albiriox, a newly emerging Android malware family promoted as a Malware-as-a-Service (MaaS) within underground cybercrime forums.\u201d<\/p>\n<p><a class=\"embed-base color-body color-body-border link-embed embed-1\" href=\"https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/11\/28\/amazon-customers-issued-48-hour-warning-attacks-already-surging\/\" target=\"_blank\" aria-label=\"Amazon Customers Issued 48 Hour Warning\u2014Attacks Have Started\" data-ga-track=\"forbesEmbedly:https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/11\/28\/amazon-customers-issued-48-hour-warning-attacks-already-surging\/\" rel=\"nofollow noopener\">ForbesAmazon Customers Issued 48 Hour Warning\u2014Attacks Have StartedBy Zak Doffman<\/a><\/p>\n<p>The malware will fully takeover phones, targeting more than 400 crypto wallets and banking applications. It works by triggering <a class=\"color-link\" href=\"https:\/\/www.group-ib.com\/resources\/knowledge-hub\/overlay-attacks\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-ga-track=\"ExternalLink:https:\/\/www.group-ib.com\/resources\/knowledge-hub\/overlay-attacks\/\" aria-label=\"overlay\">overlay<\/a> attacks, where a malicious screen is stealthily displayed over a genuine banking or wallet app, intercepting and exfiltrating your credentials as you type them into your phone.<\/p>\n<p>The attacker starts with a link to a fake Google Play Store, which currently presents a spoofed version of a popular discount retail app but could be repurposed to anything. The page does not include a direct download link, instead it requests a phone number and tells would-be users the app link will be delivered by WhatsApp.<\/p>\n<p>Malware installation<\/p>\n<p>Cleafy<\/p>\n<p>To describe this as just a red flag would be a staggering understatement. This is the very reason Google is <a class=\"color-link\" href=\"https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/08\/29\/thats-it-google-says-android-sideloading-not-going-anywhere\/\" data-ga-track=\"InternalLink:https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/08\/29\/thats-it-google-says-android-sideloading-not-going-anywhere\/\" target=\"_self\" aria-label=\"cracking down\" rel=\"nofollow noopener\">cracking down<\/a> on sideloading, controversially mandating all app developers register and prove their identity. While savvy users want to maintain their freedom, it\u2019s day-to-day users duped by schemes such as this.<\/p>\n<p>You must never give away your phone number or agree to receive an app link in this way. And if you do ever receive app installs via WhatsApp messages, do not click the links and delete the message. Installing the app will open the door to hackers.<\/p>\n<p><a class=\"embed-base color-body color-body-border link-embed embed-2\" href=\"https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/11\/28\/samsung-releases-critical-update-for-most-galaxy-users\/\" target=\"_blank\" aria-label=\"Samsung Releases Critical Update For Most Galaxy Users\" data-ga-track=\"forbesEmbedly:https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/11\/28\/samsung-releases-critical-update-for-most-galaxy-users\/\" rel=\"nofollow noopener\">ForbesSamsung Releases Critical Update For Most Galaxy UsersBy Zak Doffman<\/a><\/p>\n<p>Yes, there may be some exceptions. Very specific apps installed in very specific circumstances. But unless you tick all those boxes, this is dangerous. Period.<\/p>\n<p>This highlights \u201cthe ongoing evolution and increasing sophistication of mobile banking threats,\u201d Cleafy says. \u201cAlbiriox represents a rapidly evolving threat,\u201d but you can stay safe by sticking to legitimate <a class=\"color-link\" href=\"https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/08\/30\/google-confirms-play-store-removal-delete-apps-on-your-phone\/\" data-ga-track=\"InternalLink:https:\/\/www.forbes.com\/sites\/zakdoffman\/2025\/08\/30\/google-confirms-play-store-removal-delete-apps-on-your-phone\/\" target=\"_self\" aria-label=\"Play Store\" rel=\"nofollow noopener\">Play Store<\/a> installs and ensuring <a class=\"color-link\" href=\"https:\/\/support.google.com\/googleplay\/answer\/2812853?hl=en\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" data-ga-track=\"ExternalLink:https:\/\/support.google.com\/googleplay\/answer\/2812853?hl=en\" aria-label=\"Play Protect\">Play Protect<\/a> is enabled. <\/p>\n","protected":false},"excerpt":{"rendered":"Delete this message immediately. AFP via Getty Images This warning is very simple. Android users are now under&hellip;\n","protected":false},"author":2,"featured_media":316064,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[14728,64,63,156230,14726,178570,66819,105,178569],"class_list":["post-316063","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-android-warning","tag-au","tag-australia","tag-crypto-theft","tag-iphone-warning","tag-phone-scam","tag-play-store-warning","tag-technology","tag-whatsapp-warning"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/316063","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=316063"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/316063\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/316064"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=316063"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=316063"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=316063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}