Malicious Files and APKs Sent on WhatsApp
An APK disguised as a wedding invitation, a 'photo' that is really an app, a fake invoice. How malicious files spread on WhatsApp and how to open files safely.
A file arrives: a wedding invitation, a traffic fine, an invoice, a "photo from last night". On Android, some of these are really apps in disguise. Install one and it can read your texts, including bank and WhatsApp codes, and sometimes take control of your phone.
Common disguises
- Invitations: "Wedding_invitation.apk".
- Official documents: fines, tax notices, court papers.
- Bank and utility apps: "install the new version to keep your account".
- Invoices and delivery notes. See suspicious invoices in chats.
- "Photos" or "videos" that are really app files.
How to open files safely
- Check the file type before opening. A file ending in .apk is an app, not a document.
- Only install apps from your phone's official app store.
- Keep "install unknown apps" switched off for WhatsApp and your browser.
- If a friend sends an unexpected file, ask them by phone what it is.
- Keep your phone and WhatsApp updated.
No bank, court or tax office sends apps through WhatsApp. Treat any app file in a chat as dangerous.
If you installed something
- Turn on airplane mode.
- Uninstall the app and run a security scan.
- From another device, change important passwords and check your bank.
- Check WhatsApp's linked devices and turn on two-step verification.
Related: opening files safely and fake apps. For more, see our guide to WhatsApp scams.
Frequently asked questions
What is an APK?
An Android app installation file. Installing one from a chat bypasses the checks of the official app store and can give an app control over your phone.
Are photos and videos dangerous?
Ordinary media is generally low risk on an updated phone. Be wary of 'photos' or 'videos' that are really files ending in .apk or other app formats.
I installed an APK from WhatsApp. What should I do?
Disconnect from the internet, uninstall the app, run a security scan, change important passwords from another device, and call your bank if you use banking apps on that phone.
Sources
- How to protect your account from malware, WhatsApp Help Center
- Malware: How To Protect Against, Detect, and Remove It, US Federal Trade Commission
- About suspicious messages and scams, WhatsApp Help Center
