New China-linked spyware targets Android users via fake Signal, Telegram apps


New Delhi, Sep 4 (IANS): Cybersecurity researchers have discovered malicious Signal and Telegram Android apps distributed via the Google Play Store and Samsung Galaxy Store designed to deliver the China-linked "BadBazaar" spyware, a new report has revealed.

According to cybersecurity company ESET, the threat actors behind the malicious tool are the China-aligned APT group GREF.

The malicious Signal and Telegram apps hackers were using to infect users' devices are 'Signal Plus Messenger' and 'FlyGram'.

"Most likely active since July 2020 and since July 2022, respectively, the campaigns have distributed the Android BadBazaar espionage code through the Google Play store, Samsung Galaxy Store, and dedicated websites representing the malicious apps Signal Plus Messenger and FlyGram," said security researcher Lukas Stefanko.

The purpose of these trojanized apps is to exfiltrate user data. Specifically, FlyGram can extract basic device information, but also sensitive data, such as contact lists, call logs, and the list of Google Accounts.

FlyGram can access Telegram backups if the user enabled a specific feature added by the attackers; the feature was activated by at least 13,953 user accounts, the report said.

Signal Plus Messenger collects similar device data and sensitive information; however, its main goal is to spy on the victim's Signal communications - it can extract the Signal PIN number that protects the Signal account and abuses the link device feature that allows users to connect Signal Desktop and Signal iPad to their phones.

Previously, the BadBazaar malware was used to target Uyghurs and other Turkic ethnic minorities.

FlyGram malware was also seen shared in a Uyghur Telegram group, which aligns with previous targeting of the BadBazaar malware family, according to the report.

Victims have been found primarily in Germany, Poland, and the US, with victims also discovered in Ukraine, Australia, Brazil, Denmark, Congo-Kinshasa, Hong Kong, Hungary, Lithuania, the Netherlands, Portugal, Singapore, Spain, and Yemen.

"Both Signal Plus Messenger and FlyGram are slightly different variants of BadBazaar that focus on user data exfiltration and espionage. However, it’s important to note that each of them possesses unique malicious functionalities," Stefanko said.

 

  

Top Stories


Leave a Comment

Title: New China-linked spyware targets Android users via fake Signal, Telegram apps



You have 2000 characters left.

Disclaimer:

Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. Daijiworld.com will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will Daijiworld.com be held responsible.