Cyber-security researchers on Friday revealed a modified version of the popular messaging app Telegram on Android that is found to be malicious and can steal your data.
The malware within the malicious app can sign up the victim for various paid subscriptions, perform in-app purchases, and steal login credentials, according to the mobile research team at cyber-security firm Check Point.
The malicious app was detected and blocked by Harmony Mobile. Though innocent looking, this modified version is embedded with malicious code linked to the Trojan Triada.
"This Triada trojan, which was first spotted in 2016, is a modular backdoor for Android which grants admin privileges to download other malware," the report said.
Modified versions of mobile applications might offer extra features and customizations, reduced prices, or be available in a wider range of countries compared to their original application.
Their offer might be appealing enough to tempt naive users to install them through unofficial external application stores.
"The risk of installing modified versions comes from the fact that the user can't know what changes were made to the application code. To be more precise - it is unknown what code was added and whether it has any malicious intent," the team noted.
The malware disguises itself as Telegram Messenger version 9.2.1.
It has an identical package name (org.telegram.messenger) and the same icon as the original Telegram application.
Upon launch, the user is presented with the Telegram authentication screen, is asked to enter the device phone number, and grant the application phone permissions.
