We review vendors based on rigorous testing and research, and also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.

Learn more

Advertising Disclosure

Low-Cost Phones Come With Fake WhatsApp That Steals Crypto

Image by Dimitri Karastelev, from Unsplash

Low-Cost Phones Come With Fake WhatsApp That Steals Crypto

Reading time: 2 min

Last Updated: Apr 17, 2025

Written by Kiara Fabbri Multimedia Journalist
Fact-Checked by Sarah Frazier Content Manager

A fake version of WhatsApp pre-installed on cheap Android phones is stealing cryptocurrency by swapping wallet addresses and scanning user data.

In a rush? Here are the quick facts:

Fake WhatsApp app pre-installed on cheap Android phones.
Trojan sends user messages and images to hackers.
Hackers earned over $1 million through stolen cryptocurrency.

Security researchers have uncovered a dangerous scam involving cheap Android smartphones with pre-installed fake apps designed to steal cryptocurrency. According to Russia-based antivirus company Doctor Web, the malware campaign was first reported in mid-2024 and has grown significantly since.

The attackers are targeting users who purchase low-cost smartphones that appear similar to big-name models like the “S23 Ultra” or “Note 13 Pro.” These phones often claim to run Android 14 but are actually running modified Android 12, with fake system specs.

A trojanized version of WhatsApp, secretly installed on these phones, is at the center of the scam. Using a tool called LSPatch, hackers added a hidden module to the app. Once active, it quietly intercepts and changes copied cryptocurrency wallet addresses, a method known as “clipping.”

The malware even tricks both sender and recipient. Doctor Web explains that “in the case of an outgoing message, the compromised device displays the correct address of the victim’s own wallet, while the recipient… is shown the address of the fraudsters’ wallet.”

This version of WhatsApp also sends all user messages to the hackers and scans the device for images containing recovery phrases, often used to access crypto wallets. Many users take screenshots of these phrases, giving hackers full access if found.

Doctor Web named the trojan Shibai. It reportedly affects around 40 apps, including Telegram, Trust Wallet, and MathWallet. The campaign uses over 60 servers and 30 domains, and some hacker wallets have received over $1 million in stolen crypto.

Kiara Fabbri

Written by: Kiara Fabbri

Hi, I’m Kiara Fabbri a Tech News Writer at WizCase. I'm a multimedia journalist with a keen interest in innovative and immersive news storytelling. Fluent in three languages—Italian, English, and Spanish—I'm deeply engaged in all facets of news reporting. I am currently undertaking a Ph.D. exploring VR applications in journalism. Following my studies in psychology (BSc) and political psychology (MSc), I embarked on a three-year journey across South America. During this time, I undertook a 4000 km solo bicycle trip from Chile to Brazil. There, I camped, cooked on the road, and volunteered in various facilities. It was during these travels that I discovered my passion for journalism. Subsequently, I pursued a Master's program in journalism innovation and enterprise. My career in journalism has seen me produce VR immersive experiences covering a range of topics. These include documenting an Anti Militaristic raid of a NATO Base, life in the Brazilian Favelas, the recent violent protest clashes in Buenos Aires and finally social projects run by Skaters in the Argentinian ghettos. In addition to my journalistic endeavours, I also practice parkour, a discipline I have cultivated over several years now. I love to make the most of this skill in my journalistic style; for example, it has enabled me to capture dynamic footage from heights during the recent violent clashes in Buenos Aires. There, I scaled heights and employed a long stick on my camera to create aerial 360° views. Through my dedication to pushing the boundaries of journalism, I am committed to amplifying voices, sparking meaningful conversations, and driving positive change in the world.

Did you like this article? Rate it!

I hated it I don't really like it It was ok Pretty good! Loved it!

We're thrilled you enjoyed our work!

As a valued reader, would you mind giving us a shoutout on Trustpilot? It's quick and means the world to us. Thank you for being amazing!

Rate us on Trustpilot

0 Voted by 0 users

Title

Your email Please enter a valid email address.

Comment

Thanks for your feedback

Please wait 5 minutes before posting another comment.

Comment sent for approval.

Leave a Comment

Show more...

Share & Support

WizCase is reader-supported so we may receive a commission when you buy through links on our site. You do not pay extra for anything you buy on our site — our commission comes directly from the product owner. Some providers are owned by our parent company. Learn moreWizcase was established in 2018 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, Intego and Private Internet Access which may be ranked and reviewed on this website. The reviews published on Wizcase are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article..