Alert, Researchers Find New Android Malware That Can Break Through WhatsApp And Telegram Messages

Malware that can break through WhatsApp and Telegram (doc. unsplash).

JAKARTA As an end-to-end encrypted application, Telegram and WhatsApp should be able to keep messages in the conversation room. This message should not be read by third parties, including application developers.

However, security researchers discovered a very dangerous Android malware. The malware, calledturnus, can break through users' devices, control its devices, and even steal banking credentials in it.

Another dangerous thingturnus can do is break through encrypted messages. This malware can attack popular apps, such as Telegram and WhatsApp. Signal, this popular application in the United States and Europe, can also be broken down byturnus.

"(Sturnus) not only stole credentials and allowed the takeover of the device is full, but also read encrypted chats by capturing content after decryption," said Chief Information Security Officer (CISO) Keeper Security Shane Barney, in a statement received by VOI on Saturday, November 29, 2025.

This malware misuses Android permission to spy on screens and record messages in real-time. In addition, it can run transactions while hiding warnings that could indicate fraud.

Preliminary activity shows that this malware is being tested in targeted campaigns. However, the components combined by Sturnus have been well tested. This shows that Sturnus can move quickly after its distribution method is improved.

Barney advised security actors to strengthen company application mobility and installation controls, as well as require strong endpoint detection. He also reminded the importance of blocking accessibility and remote control permits, unless they are indispensable and have been verified.

"Effective security must be holistic, incorporating strengthened endpoints, locking access lines, and a built-in defense for an environment where attackers will increasingly target humans and handheld devices," Barney said.