A fake Netflix app was accepted into the Google Play app store, then used WhatsApp's auto-reply function to spread links to itself so that it might be installed on even more phones.
The app, called "FlixOnline," promised users it could connect them to Netflix streams from other countries, where different movies and TV shows might be available, as well as give you two free months of Netflix membership.
- The best Android phones right now
- Protect your privacy with the best encrypted messaging apps
- Plus: Android Auto is getting a major upgrade to take on Apple CarPlay
But the app really just monitored WhatsApp notifications and replied to WhatsApp messages, researchers from Israeli security firm Check Point said in a blog post and a research paper today (April 7).
There is no indication that WhatsApp itself was hacked, or that this exploited a vulnerability in WhatsApp. It's also not quite clear what the FlixOnline app did other than to promote itself.
Check Point said the FlixOnline app had the ability to, at least in theory, steal passwords or spread spam. The app did hide its icon after installation, a sign that it was up to no good.
How this worked, and what to do
If you have the FlixOnline app on your phone — it should appear in Settings > App Info — then you'll need to delete it right away. As always, having one of the best Android antivirus apps installed will help you avoid infection.
To every incoming WhatsApp message on a user's phone, the FlixOnline app would automatically reply with a message promoting itself, along with a shortened link for the recipient of the message to tap on. (The malware itself was not spread via WhatsApp and hence not truly "wormable.") The link leads to a site called GetMyFlix-dot-com, which is now offline.
Check Point pointed out that the shortened link could have led anywhere or tried to install more malware that might steal your personal information or hijack your WhatsApp account. But there's no indication it actually did anything other than try to get you to download the FlixOnline app.
Not the first time we've had this dance
This malware attack is very similar to a scam we reported in March 2020, just as coronavirus lockdowns were put into effect in Europe and North America, that also used WhatsApp (as well as text messages) to spread messages about a phony service that got you two free months of Netflix.
Check Point noted that the FlixOnline app requested Overlay permissions, which could be used to create fake login screens to steal passwords, but which other apps — Facebook Messenger, to name one example — also use to post onscreen notifications. FlixOnline also uses the Notification permission to reply to incoming messages with automatic replies.
"Theoretically," says the Check Point blog, "th[r]ough these auto-generated replies, a hacker can steal data, cause business interruptions on work related chat groups, and even extortion by sending sensitive data to all the users contacts."
So what's the danger?
We don't know whether the FlixOnline app actually did this. It's just as likely that it only showed ads to infected users. Check Point said that despite the aggressive WhatsApp promotion campaign, the FlixOnline app had been installed only about 500 times.
The app is no longer in the Google Play store, but it shouldn't have been in there at all. Limiting app downloads to Google Play is one of the core defenses Android has, and malicious apps in the store undermine the whole system.
Perhaps with so few users, there weren't enough complaints about this app for the Google Play store's managers to notice.
A WHOIS lookup of the WhatsApp link's destination domain, GetMyFlix[.]com, shows that it was registered in March 2020 by someone claiming to be in the remote Andaman and Nicobar Islands state of India.
The Internet Archive's Wayback Machine has several "captures" of the website dating from 2008 to 2014, when it seemed to encourage people to "borrow" rented DVDs from neighbors.
The Google Play page for FlixOnline, screenshotted by Check Point, claims to be developed by someone named "Jillian Sanchez."
