Fake WhatsApp and Telegram apps found on budget Chinese smartphones

Trojanised apps harvest users’ details

A new cybersecurity report has revealed that several low-cost Android smartphones from Chinese manufacturers come with pre-installed fake versions of WhatsApp and Telegram.

Security researchers at Doctor Web revealed that since June 2024, these low-cost phones, mostly imitating popular models from brands like Samsung and Huawei, have come preloaded with trojanised messaging apps that can hijack crypto transactions and harvest sensitive data.

Most of the affected devices were sold under names such as S23 Ultra, S24 Ultra, Note 13 Pro, and P70 Ultra, which are mainly produced by the SHOWJI brand.

It goes further to say that the fake apps could even fool popular system information tools, making the phones appear as if they run the latest Android 14 software with superior hardware, when in reality, they operate on outdated systems with far less capability.

Although Dr Web’s report states that Chinese users who lack access to foreign messengers are the primary target, these phones are likely distributed in various international markets since they imitate popular models.

Malware injected via supply chain weaknesses

To set the malware to work, attackers exploited the supply chain of these products and embedded a malware dubbed “Shibai,” into legitimate-looking apps using an open-source tool called LSPatch before they reached customers.

Once active, it scans chat messages for cryptocurrency wallet addresses and swaps them with those controlled by the attackers, diverting funds during transactions. The malware also searches device folders for images containing wallet recovery phrases, giving hackers the means to empty victims’ crypto wallets. While the report claims many crypto wallets were affected, MathWallet and Trust Wallet were the most hit.

The campaign is believed to have netted attackers over $1.6 million in stolen cryptocurrency over the past two years.

This is not the first time Chinese smartphones have been caught with pre-installed malware. In June 2014, security experts at G Data discovered spyware on a popular Chinese Android phone, Star N9500. Later that year, researchers from Palo Alto Networks found that high-end Android phones from a Chinese telecom firm Coolpad’s included a secret backdoor called CoolReaper.

The recurrence of these issues raises concerns about the reliability of Chinese-made smartphones. Amid ongoing trade tensions between the United States and China, these sorts of revelations could further strain relations and impact consumer confidence globally.

After two years of decline, China's smartphone market experienced a significant 4% growth last year, with 285 million units shipped according to research firm Canalys. Domestic brands like vivo and Huawei have been leading the market, with vivo holding a 17% share and Huawei at 16%. Apple, once the market leader, saw its share drop to 15% due to intense competition from local manufacturers.

Want to know more? Computing 's Cybersecurity Festival returns to London in May, where senior IT decision makers can learn about modern challenges, compare strategies with peers, and source solutions. Click here to register for free.