Meta sues several Chinese companies for stealing over 1 million WhatsApp accounts

The development comes nearly two months after WhatsApp head Will Cathcart announced in a tweet that the company is taking enforcement action against HeyMods to stop "future harm".

WhatsApp parent firm Meta has sued several Chinese companies for stealing over a million account details. These companies were allegedly doing business as HeyMods, Highlight Mobi, and HeyWhatsApp, in other words, unofficial WhatsApp platforms. WhatsApp has repeatedly warned users against mod-apps - in this case, modified WhatsApp platforms that offer extra features are not available on the official apps. The malware-infested apps were available on several APK sites and the Google Play Store.

According to the complaint filed in the US District Court in San Francisco and reported by Bleeping Computer, some of these modified WhatsApp were downloaded a million times. Once a user downloads the malware-laden apps (such as Theme Store for Zap and AppUpdater for WhatsPlus 2021 GB Yo FM HeyMods), the application prompts them to enter their WhatsApp user credentials and authenticate their WhatsApp access to the Malicious Applications. If successfully breached, attackers can access sensitive messages and other information.

The jurisdiction of these developers remains unclear as many companies are based in Chinese territory. However, the complaint notes that the court has "personal jurisdiction" over the defendants (Chinese companies) because they "knowingly directed and targeted their scheme at Meta and WhatsApp, which have their principal places of business in California". It essentially means that defendants agreed and were bound by the WhatsApp Terms when they created various WhatsApp accounts.

The development comes nearly two months after WhatsApp head Will Cathcart announced in a tweet that the company is taking enforcement action against HeyMods to stop "future harm". He even said that Google Play Protect on Android can now detect and disable previously downloaded malicious fake versions of WhatsApp. Cathcart reminded users to not download modified WhatsApp versions.

Meanwhile, Meta has released a list of over 400 apps potentially stealing users' Facebook login credentials. The company said that apps were removed from Google Play and Apple App Store once the company discovered their activities. Most of these apps offer a fake "login with Facebook" prompt and steal users' IDs and passwords.