So the malware is installed by the user which then spams users contacts to install it too? And to do this you need to: 1 install shady app, 2 ignore security warnings and 3 manually give it special access to access user communication?
Yes, users can be very stupid but I wouldn't call this "wormable.
(Although we could all agree that Googles evaluation process is basically whack-a-mole).
For these users I think it's pretty easy to fall for this. After all apps request overbroad permissions all the time and most users don't have the expertise to evaluate permissions nor the reputability of the publisher.
The message it sent was very poor IMO. A better strategy would be:
Reply with "Here's that Netflix-anywhere app I mentioned a while back. https://bit.ly/whatever"
If there is a follow-up message from the same contact, reply with "Oh sorry, meant for someone else, but you can use it if you like too! Grab it now, I'm about to delete the link".
Then if there is a third or any further replies, simply mark them read and block them from appearing to the user for 24 hours.
Seriously though, I wonder if the reason is that the creators speak English as a second language.
In any case, this obviously targets the less savvy users and it would probably be better labelled as "phishing" rather than "wormable".
Maybe WhatsApp devs ignored that.
Whatever happened to that saying...
'If it sounds too good to be true, it probably is.'
It's especially applicable to any software promising to do anything slightly sketchy.
Free apps with overblown claims are the snake oil of the internet. For every 1000 you find claiming to do this that or whatever amazing thing one may actually be real, 99 are probably useless and the other 900 are probably malicious.
I dunno, I try to think of installing software as letting someone come live in my house who may bring all their buddies with them. The more permissions an app wants, the more of my stuff that person's going touch and fuck around with while living in my house. There's also a good chance they'll let their buddies touch my stuff.
So you gotta think a bit about whether you want someone else in the house, you've probably got a little party going on already, and everyone's already messing with your stuff dammit.