Arsenik Spyware Posing as WhatsApp, YouTube, Instagram, and TikTok Hits 143 Countries
- Jan 31
- 2 min read
Arsink Spyware Posing as WhatsApp, YouTube, Instagram, TikTok Hits 143 Countries
Key Findings
Arsink is a dangerous Android Trojan that impersonates over 50 popular brands, including WhatsApp, YouTube, Instagram, and TikTok
The malware has infected over 45,000 devices across 143 countries, with major clusters in Egypt, Indonesia, and Iraq
Arsink grants hackers complete remote control, allowing them to record audio, read text messages, and wipe devices
Background
A massive new spying operation has been discovered targeting Android users across 143 countries. The malware, known as Arsink, is a Remote Access Trojan (RAT) that was uncovered by researchers at Zimperium zLabs.
The 'Pro' App Trap
Hackers are not using the official Google Play Store to spread Arsink, but are instead posting links on Telegram, Discord, and the file-sharing site MediaFire. They impersonate over 50 well-known brands, offering "Pro" or "Mod" versions of popular apps like WhatsApp, Instagram, YouTube, and TikTok, promising special features. Once installed, the apps immediately request a long list of permissions.
Gaining Total Control
Once Arsink is installed, it starts a "continuous background service" to maintain control. The malware has a terrifying list of abilities, including the capacity to listen to conversations, steal photos, read text messages, access contacts and call history, and even wipe the entire device storage. The hackers can also send live commands to the infected device.
A Global Problem
The Arsink infection has a massive global footprint, with around 45,000 devices hit so far. The largest clusters are in Egypt (13,000 phones), Indonesia (7,000), and Iraq (3,000). Researchers concluded that Arsink is an "opportunistic, mass-distribution threat" leveraging brand impersonation and social platforms to achieve worldwide penetration.
Staying Safe
While Zimperium has worked with Google to shut down some malicious accounts and databases, the threat is ongoing. To stay safe, users should only download apps from official app stores and avoid any "free" premium apps promoted on social media.
Sources
https://hackread.com/arsink-spyware-whatsapp-youtube-instagram-tiktok/
https://x.com/HackRead/status/2017259904789045342
https://www.socdefenders.ai/item/932b01b1-6009-41c5-9141-b4e81b358abf
https://www.facebook.com/HackRead/posts/%EF%B8%8F-android-users-watch-out-arsink-spyware-posing-as-whatsapp-youtube-instagram-ti/1458656946259878/
https://www.linkedin.com/posts/lorenzogomezvargas_arsink-spyware-posing-as-whatsapp-youtube-activity-7423099763514003456-6NoB
Comments