1. Source verification
We only mirror APK files from developer channels that we have independently verified — typically the public Telegram channel or website of the mod community member who built the release (AlexMods, FouadMods, or HeyMods). We do not accept APKs forwarded over chat or sent by email, regardless of who they come from.
2. VirusTotal scan
Every file is uploaded to VirusTotal and scanned against 70 plus antivirus engines. The full scan report is linked publicly on the corresponding download page along with:
- SHA-256 hash of the APK file.
- Detection count (for example,
0 / 72 engines). - Date the scan was run.
- Direct link to the live VirusTotal report.
A small number of antivirus engines may still classify the file as Android.Riskware.Modded or similar. This is a category every antivirus vendor applies to modified versions of popular apps, regardless of actual malware content. We never publish an APK that is flagged by a traditional malware signature.
3. Manual install on a real device
The APK is installed on a test Android phone — currently an Infinix Hot 60i running stock Android 15 — using the exact steps documented in our install guide. We do not use emulators for install verification because emulators do not replicate WhatsApp's device fingerprinting behaviour.
During install we verify:
- APK signature integrity (no silent tampering).
- Permission audit — only standard chat permissions requested, nothing extra.
- Successful first launch and number verification.
- Backup restore from an existing WhatsApp backup, without errors.
4. Network behaviour check
We monitor the device's outgoing connections for the first 24 hours after install using a router-level inspection tool. Any connection to a domain that is not part of the official WhatsApp / Meta infrastructure is logged and investigated. APKs that contact unknown advertising or tracking networks are not published.
5. Seven-day ban check
The test number is left active on the new APK for a full seven days of normal use — sending messages, joining a group, sharing media. If WhatsApp flags or restricts the account at any point, that is recorded in the public safety report for the release and the APK is held back from publication.
6. Final review and publishing
Only after the previous five steps complete with acceptable results does the APK get added to the download page. Each published version carries:
- A "Safety report" link with the scan report and lab notes.
- A clear "Released on" date and tested-device summary.
- The same honest disclaimer we use on every product page.
7. What you do not see, but we still do
A few additional checks happen quietly in the background and do not get their own section on every download page:
- Comparing the APK's certificate fingerprint to the previous version we published. Mismatches are investigated before publishing.
- Disassembling sensitive code paths (encryption, network, storage) on the first build of a major version line to confirm no behavioural surprises.
- Spot-checking community feedback for the release on independent forums during the seven-day window.
8. Limitations we want to be honest about
Even with this workflow, no review process can guarantee a piece of third-party software is safe in every scenario. We test on a small set of devices, and Android behaviour varies. We also cannot predict policy changes by WhatsApp Inc. that may affect modified clients. If you are using your main phone number for banking, business, or any other high-stakes communication, please use the official WhatsApp app instead.
9. Reporting issues
If you spot something we missed — a permission you don't trust, a connection that looks wrong, a feature that misbehaves — write to [email protected]. We acknowledge security reports within 24 hours and update the relevant publication within 72 hours if the report holds up.