Chinese Android Phones Shipped with Fake Apps Targeting Crypto Users

Doctor Web reports that cheap Android phones from Chinese manufacturers were found with trojanized WhatsApp and Telegram apps pre-installed, containing cryptocurrency clipper functionality as part of a campaign active since June 2024. The malware, dubbed Shibai, is built with the open-source LSPatch project and reportedly modifies about 40 applications, including messengers and QR code scanners, to swap Ethereum and Tron wallet addresses in chats. The malware also uploads WhatsApp messages and images from device folders to the attacker's server, where the images are scanned for wallet recovery phrases. Doctor Web says the attackers have received more than $1.6 million over the last two years across nearly two dozen wallets.