New Year Greeting Scams Deliver Mobile Malware via WhatsApp & Telegram

A highly coordinated and timely malware campaign is capitalizing on the global spirit of New Year celebrations, turning festive greetings into vectors for financial theft. Security agencies and law enforcement in India, including the Telangana Police and the Indian Computer Emergency Response Team (CERT-In), have issued urgent alerts regarding a surge in malicious activity spreading through WhatsApp and Telegram. The campaign exemplifies a dangerous blend of sophisticated social engineering and mobile malware, specifically designed to drain victims' bank accounts.

The attack chain begins with a seemingly innocent message. Users receive a personalized New Year's greeting, often from a compromised or spoofed contact, containing a link to view a "special digital greeting card" or an "exclusive New Year video." The message is crafted to evoke curiosity and trust, leveraging the festive season's goodwill. Clicking the link does not lead to a greeting but to a fraudulent website designed to mimic a legitimate greeting card platform or video player. This site urgently prompts the user to download an Android application package (APK) file to view the content, claiming compatibility issues or the need for a "special viewer."

This is the critical infection vector. The downloaded APK file contains a potent banking trojan, a variant of malware families like Anatsa or Xenomorph, which has been repurposed for this seasonal attack. During installation, the app requests a wide array of intrusive permissions, including accessibility services, SMS access, notification reading, and overlay capabilities. Granting these permissions effectively hands over control of the device to the attackers.

The malware's capabilities are extensive and focused on financial fraud. Once installed, it operates stealthily in the background. Its primary functions include:

1. SMS Interception: It monitors and reads all incoming SMS messages. This allows it to capture one-time passwords (OTPs), transaction alerts, and bank verification codes, effectively bypassing a common layer of two-factor authentication (2FA).
2. Overlay Attacks: Using its overlay permission, the malware can create fake login screens that perfectly mimic legitimate banking and financial apps. When a user opens their real banking app, the malicious overlay is displayed on top, harvesting their login credentials.
3. Remote Access & Keylogging: Some variants establish a backdoor connection, allowing attackers to remotely control the device, navigate apps, and log keystrokes.
4. Unauthorized Transactions: Armed with stolen credentials and intercepted OTPs, the attackers can initiate fund transfers, make purchases, or modify account details directly from the victim's device.

Authorities emphasize the professional execution of this campaign. The phishing messages are well-translated and the fake websites are convincingly designed, lacking the obvious grammatical errors or poor design that often characterize scams. This increases the likelihood of successful deception, even among somewhat cautious users.

The campaign's impact is assessed as high due to its scale, timing, and direct financial consequences. It targets a vast user base on ubiquitous platforms (WhatsApp and Telegram) during a period when people are more receptive to unsolicited greetings and may let their guard down. The regional alert from India often serves as an early indicator of a campaign that may spread to other English-speaking and global regions, adapting the messaging to local holidays and customs.

Broader Implications for Cybersecurity:
This New Year scam is not an isolated incident but part of a recurring trend where threat actors leverage major holidays and cultural events—such as Christmas, Diwali, or tax season—to launch social engineering campaigns. The technical infrastructure, including the malware payload and command-and-control servers, is often reused and slightly modified for each new theme, allowing for efficient and scalable attacks.

Recommendations for Mitigation:

• Technical Controls: The most critical defense is to disable the "Install from unknown sources" setting for all apps, especially browsers and messaging apps, in the Android security settings. This blocks the installation of APK files from websites.
• User Awareness: Users should be educated to treat links in unsolicited messages—even from known contacts—with extreme skepticism, especially during holidays. Hovering over links to preview the URL (on desktop) or checking with the sender via a separate channel can help.
• Source Verification: Only install applications from the official Google Play Store or Apple App Store. These platforms have security screening, though not infallible, that reduces the risk.
• Permission Scrutiny: Be highly suspicious of any app, especially one claiming to be a media viewer, that requests accessibility services, SMS access, or overlay permissions. These are red flags for malware.
• Incident Response: Organizations should consider issuing internal advisories to employees ahead of major holidays, warning of such seasonal phishing and malware threats targeting personal devices that may hold corporate data or credentials.

The "New Year's Greeting Trap" underscores the persistent evolution of social engineering. As digital communication becomes central to our celebrations, cybersecurity vigilance must become an equally ingrained habit, regardless of the season.