Hackers steal Signal, WhatsApp user data with fake Android chat app – Bleeping Computer

Hackers are using a fake Android app named ‘SafeChat’ to infect devices with spyware malware that steals call logs, texts, and GPS locations from phones. The Android spyware is suspected to be a variant of “Coverlm,” which steals data from communication apps such as Telegram, Signal, WhatsApp, Viber, and Facebook Messenger. CYFIRMA researchers say the Indian APT hacking group ‘Bahamut’ is behind the campaign, with their latest attacks conducted mainly through spear phishing messages on WhatsApp that send the malicious payloads directly to the victim. Also, the CYFIRMA’s analysts highlight several TTP similarities to another Indian state-sponsored threat group, the ‘DoNot APT’ (APT-C-35), that has previously infested Google Play with fake chat apps acting as spyware. Late last year, ESET reported that the Bahamut group was using fake VPN apps for the Android platform that included extensive spyware functions. In the latest campaign observed by CYFIRMA, Bahamut targets individuals in South Asia. “Safe Chat” details While CYFIRMA doesn’t delve into the specifics of the social engineering aspect of the attack, it’s common for victims to be persuaded into installing a chat app under the pretext of transitioning the conversation to a more secure platform. The analysts report that Safe Chat features a deceiving interface
Read More