Beware of Clubhouse Invitations on Android: They’re Malware
Android users are receiving fake Clubhouse invites that actually push them to download dangerous malware.
The growth of the Clubhouse and the desire for invitations have grown so large that a similar move by malware creators was to be expected. In recent times, applications that pretend to be this social network and Trojans hidden in false invitations have been discovered.
First of all it should be clarified that There is no Clubhouse app for Android yet nor is it expected to be in a couple of months, as reported by one of its founders. Knowing this, the first reaction should always be to be suspicious if an invitation for this operating system is received.
But the volume of attacks under this strategy is quite high, as reported in TechRadar, so much so that it is not possible to calculate how many affected there are. In ESET they have discovered several websites that pretend to be a Clubhouse with Android applications that hide a well-known Trojan named BlackRock.
According to Lukas Stefanko, a researcher at ESET, the web “it is a well-executed copy of the official Clubhouse site. Nevertheless, Once the user clicks ‘Get from Google Play’, the application will automatically download to the device. Contrary to legitimate websites, which always redirect the user to Google Play, rather than directly downloading an Android package or APK for short“.
So it warns of the second warning sign: it is normal for the application to be downloaded from Google Play, not directly from a website.
This Trojan is ready to steal data from other applications, including some especially well-known ones, such as Twitter, WhatsApp, Facebook, Amazon, Netflix, Microsoft Outlook, eBay, BBVA … In addition, it is also advised that it has the ability to intercept and analyze SMS received on mobile, allowing you to bypass two-step authentications of some applications.
The summary is simple: There is currently no Clubhouse application for Android, so you should be wary of any invitation that indicates it. And when this app is launched, download it only on Google Play, never on any other website.