email virus WhatsApp - sending itself to all in my address book

I got exactly the same on my non Apple device. I foolishly opened it and multiple messages were forwarded to what looks like my entire address book. I agree, this seems to be within GMail. I changed my password and logged out of GMail. When I logged in again I have so far seen no repiitition of the problem.

Here's hoping this is fixed.

I hope this works for you

I also have a friend who rec'd this...I didn't think it was possible without providing a password but she swears that no passwords were collected. She clicked the link and attempted to play the message but instead it sent an email to every contact in her Gmail address book. I have a copy of the message and I'm thinking of trying it on a safe Mac with a fake email and address book. I didn't think us Mac folk could be vulnerable to this kind of thing but I really think this may be the real thing...

David Maffucci wrote:

I have a copy of the message

If you don't mind, could you send me a copy, to thomas at thesafemac dot com? I'd like to take a look at it and see what's going on.

I have just had this happen t me. I'm an idiot. when I clicked on play on the whatsapp thing it took me to an iCloud page which asked for my iCloud sign in. Since then I my email account has sent out identical messages and (presumably as a result) I got locked out of my apple i.d and therefore iCloud (I have a @me.com account) and so I have had to change the password. this meant not being able to send or resend e mails. I have changed password. Do you think this means I am now ok? I use that password on other stuff too. I'm guessing I need to change everything now?

I also have this on my IMac and I accidentally (pre-occupied) clicked on it last Tuesday and suddenly it started sending emails to all and sundry.

I have since run a Sophos full virus check (nothing found) and also run a Malware checker which did find a couple of things but not this.

I have changed my password on my Gmail account and done all the security things that they suggest.

However last night it again started sending emails from my account.

I have not changed my Apple password for my @Me account, so I guess I need to do that, however I am not confident that this will work ??

I will download and run Etracheck as soon as I get home later and would appreciate your feedback ?

Thanks

René

You need to change you apple id immediately. The way it got into my email was through iCloud. Your apple id and iCloud are probably the same password. I would then check iTunes account to make sure no purchases have been made. hope this helps. total bummer.

All set...message sent. Thank you.

David Maffucci wrote:

All set...message sent. Thank you.

Thanks!

I took a look at this, and ran it in a test system with a test GMail account logged in. However, clicking the link there didn't do anything with my particular GMail account. Instead, it loaded a very convincing GMail login page. (Convincing, at least, if you didn't look at the address bar and see the site shown there wasn't gmail.com.)

More interestingly, it seems to be keyed to one particular GMail account:

The fake login says the session has expired, and prompts me to log back on as esther****@gmail.com. I'm assuming this particular e-mail was targeted specifically at her.

So, I have two thoughts. One is that the targeted accounts have already been compromised, and that the WhatsApp e-mail is a symptom of that hack, not a cause. The other is that the folks clicking this link see their e-mail address already entered in a convincing phishing page, and they enter their password without even thinking about it or remembering that they have done so. Especially if the phishing site then redirects back to GMail, which the user is already logged into, and thus the login would appear to have worked as expected.

thomas_r.

Thanks!

I took a look at this, and ran it in a test system with a test GMail account logged in....

No, thank you! I've spoken with the person who had the email broadcast send and she is now saying that it is possible she did put in her password. Also that address it seemed to be keyed into is the recipient of this particular fake WhatsApp email so it seems to make sense, you click the link, a fake Gmail box pops up already filled out with your username and it asks for your password. You mindlessly plug in the one require piece of info and kablam, everyone in your address book gets an email tailored to them...nasty...

I would agree that a password change will take care of most issues.

I did not give any passwords and this virus still managed to hack my mail account from my Mac.

I clicked on the WhatsApp Link, got transferred to a site showing some weight loss infos and a movie clip. It looked like a BBC webpage. I clicked on the movie clip. After a few minutes my mail account sent out Emails to all contacts. Scary.

That's exactly what happened to my mum on her iPad she didn't put any password in and it still sent emails to everyone in her contacts. The email she got from an @me account. Her webmail provider stopped all the emails but she has a sky email not gmail or @me. Will the iPad have been compromised.

alisonfromchelmsford wrote:

Will the iPad have been compromised.

No. There is no, and has never been any, malware that is capable of infecting an iPad through e-mail. All currently known iPad malware requires that the iPad be jailbroken (ie, hacked to allow apps from outside the App Store) or physical access to the iPad by a hacker. There are theoretical exploits that could allow malware to be downloaded from a web site, with the assistance of the user, but exactly how this works is still a bit unclear... it probably requires multiples steps.

Thanks for all your advice on this. Very helpful. I had the same fake What'sApp email attachment sent to me today and I too foolishly entered my password to access the attachment, and, whizzo, emails were sent to all my iCloud contacts (but not to my contacts linked to my other email addresses). Fortunately Apple detected the security threat and quickly locked access to my iCloud account. Resetting the password sorted out the problem, but it was tiresome to have to do it on iPhone and iPad as well as Mac.

What I don't understand is what the hackers get out of this. There's no money involved, there's no privileged information disclosed, it seems to be just a question of promoting anarchy. Is there something I'm missing here? Can such a hacking attack actually provide the perpetrators with anything valuable?

.