Urgent warning to anyone who uses WhatsApp on an Android phone

An urgent warning has been issued to anyone with an Android phone that uses WhatsApp.

While the iPhone is king in both the United Kingdom and United States, with it holding 52 percent and 60 percent of the market respectively, Android is king across the world.

As of early 2024, the open source operating system holds around 70 percent of the market across the planet; this equates to roughly 3.6 billion of people on Earth.

Phones with an Android OS also accounted for more sales in the final quarter of 2023, showing it has a grip on the phone market despite all of Apple's slick marketing and bright lights.

And with roughly two billion people using WhatsApp across the world to message their loved ones, friends, and colleagues, it's a major worry when criminals target them.

Now, a new threat has been discovered impacting Android users and in particular, those with WhatsApp.

The security team at IBM Trusteer spotted the security breach, through a piece of malware that constantly mutates and changes.

It secretly hides on your device, always watching and eventually stealing details such as banking details and other personal information.

Drew Angerer/Getty Images

The malware is PixPirate and it can track every single swipe and type of your screen. It'll monitor everything, basically, including what apps you're using and what you browse online.

Two-Factor authentication is also no good against PixPirate, with those behind the malware able to access edit and delete the your SMS messages, which includes the codes from your bank.

PixPirate is now spreading on Android devices via WhatsApp.

IBM Trusteer says: "Usually, victims get infected with PixPirate by downloading the PixPirate downloader from a malicious link sent to them through WhatsApp or an SMS phishing (smishing) message. This message convinces the victim to download the downloader, which impersonates a legitimate authentication app associated with the bank.

"Once the victim launches the downloader, it asks the victim to install an updated version of itself, which is, in fact, the actual PixPirate malware."

Omar Marques/SOPA Images/LightRocket via Getty Images

Right now, most of the infections seem to be taking place in Brazil.

Google has responded to the threat and calmed fears that people might have.

The company says as long as you have Google Play Protect, your device will be secure.

A statement said: "Based on our current detections, no apps containing this malware are found on Google Play.

"Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.

"Google Play Protect can warn users or block apps known to exhibit malicious behaviour, even when those apps come from sources outside of Play."

• ‘World’s best hacker’ issues urgent warning to anyone who shares iPhone chargers
• Ethical hacker has a warning for anyone who uses any of these 10 passwords
• Urgent warning issued to anyone still with an old burgundy British passport
• How to switch off UK government emergency alert ahead of today’s phone test