#Teaser - MBWA iOS

• As requested, the style has been redesigned when viewing a status.

@MBMods

- #Teaser - MBWA iOS

• Did you reply to an edited message and give away that you use a WhatsApp mod?

Now the history is displayed in a floating dialog box by clicking on the "Edited - View history" label.

@MBMods

#Teaser - MBWA iOS

• As requested, it is now possible to schedule messages.

@MBMods

#Teaser - MBWA iOS

The edited message history now lets you quickly recognize changes made, highlighting any changes in the new message.

@MBMods

#Teaser - MBWA iOS

• When scheduling a message in a group, you can have it mentioned to everyone.

@MBMods

⚠️ Warning!

A growing number of WhatsApp mods are quietly stealing your personal data.

That includes:

- Your phone number
- Your contacts' phone numbers
- Access to your messages
- Data from digital wallet apps (Binance and similar apps)

The collected information is then sent to a hidden private server.

After analyzing the hidden code, it raises every possible red flag. (See the image.)

What's even more concerning is that this code is heavily obfuscated, making it inaccessible even to your favorite "mod developer." Despite the strong protection, some parts of the code were left exposed, allowing me to identify what it's doing.

WhatsApp mods that contain this data-stealing code:

- GBWhatsApp by Abu Saleh
- VCTM and any YessiMods remod
- DH WhatsApp (the first mod to include this code—others later adopted it)
- Delta WhatsApp
- Karina WhatsApp
- Delta Extreme WhatsApp
- CM WhatsApp / CM Activator
- WhatsApp Nova
- WhatsApp Gold
- ARWhatsApp
- HT3WhatsApp
- WaPlusClean
- Any remod based on Abu Saleh's GBWhatsApp
- Any mod with "Activator" in its name
- Any other mod that promises 100% successful account linking

It doesn't matter which package or version you install—they all behave the same way.

If a mod promises "100% successful linking," ask yourself what it's getting in return.

In many cases, the answer is your data.

How can I tell if my favorite WhatsApp mod contains this malware?

If you're an advanced user, you can inspect the APK using tools such as ApkEditor, ApkTool, or MT Manager.

1. Check the assets folder

If you find any of these files:

- "xprmtofk"
- "ydzntloe"
- "iintbpzx"
- "mieduyzc"
- "pdsydpnb"
- "wqncallq"

then the mod has been injected with this malicious code.

2. Check the DEX files

Open each ".dex" file and look for the following path:

"/androidx/app/xirs/"

If this directory exists, the mod contains the same malicious code.

---

What are these files for?

They only need to be added to any WhatsApp build to make the famous "100% successful account linking" work... 😂

The price? Your data.

---

Does MBWhatsApp contain these files?

No.

I've known about this for months, but I'm only sharing it publicly now so more users are aware of it.

This is also why account linking in MBWhatsApp doesn't work reliably for everyone—including me.

MBWhatsApp is used by my partner, friends, and me, so security and privacy are important.

---

Since when has my data been at risk?

Since the latest code used for account linking was introduced—roughly 3 to 4 months ago, as far as I can tell.

---

Which mods don't contain this malware?

I haven't reviewed every mod, but after checking several, these appear to be clean:

- WhatsApp LiteX
- MBWhatsApp
- LX WhatsApp
- OX WhatsApp

However, if any of these require you to install an "Activator" app, your data is at risk as soon as you install it, (the risk is zero when you install the mod on top of the activator)

Unlike the mods mentioned previously, those already include the malicious code running continuously in the background and collecting data.

---

Can I inspect these files myself?

Only if you're a very advanced user.

The files are heavily protected and intentionally difficult to analyze. I've already unpacked and analyzed them, which is why I'm sharing this information.

---

Why doesn't VirusTotal detect the files in the assets folder?

Because VirusTotal treats them as corrupted or unknown files.

Once they're unpacked and analyzed again, they trigger the detections shown in the previous post.

However, VirusTotal does detect the "/androidx/app/xirs/" directory, which is why mods containing it usually show multiple malware alerts.

---

Which server is my data being sent to?

If you have experience capturing encrypted networks, then check out these links:
- chunkchain. site
- ds_new_fmwa.hasuaki. xyz

---

Did the owner of your favorite mod come out and deny this?

---

This isn't the first time something like this has happened.

The same thing occurred with the HeyWhatsApp mod, which was eventually abandoned after its malicious behavior was exposed.

Read more here:

https://mybroadband.co.za/news/security/452388-fake-whatsapp-warning.html

The new version is coming soon; it will be released before version 2.8.1 expires.

🚀 New Update 🚀

#MBWhatsApp v3.0

📆 15-08-2026

📝 Changes:

✨ New base updated to 2.26.19.73
~ Small changes and improvements

🪲 Any bug? report it @mbmods_reportbot

📎 Download and details:
👇🏻
https://mb-mods.net/mbwhatsapp/?a

🚀 New Update 🚀

#MBWhatsApp v3.3.4

📆 17-10-2026

📝 Changes:

✨ New base updated to 2.26.30.97

⚠️ Please note that this version is still under development and was only released to help users experiencing issues with the previous version expiring.

🪲 Any bug? report it @mbmods_reportbot

📎 Download and details:
👇🏻
https://mb-mods.net/mbwhatsapp/?a