Subj : Fake Android chat app lets hackers steal Signal, WhatsApp user da
To   : All
From : TechnologyDaily
Date : Tue Aug 01 2023 16:15:03

Fake Android chat app lets hackers steal Signal, WhatsApp user data

Date:
Tue, 01 Aug 2023 15:06:13 +0000

Description:
Spyware targets Android users, aiming to collect information about victims in 
real time.

FULL STORY
======================================================================

Experts have raised the alarm about yet another case of Android malware under 
the cover of a dodgy app, this time spreading across South Asian countries. 

According to cybersecurity company Cyfirma , the dummy chatting app which 
goes by the name Safe Chat on victims devices is said to have higher levels 
of permissions compared with another similar instance of malware that it has 
been compared to. 

After analyzing the malware, Cyfirma has revealed suspicions that the latest 
attack is yet another by Indian APT hacking group Bahamut. Safe Chat app is 
not safe 

Once delivered via WhatsApp and installed, the Safe Chat app throws up a 
series of pop-up messages, including one asking the victim to allow 
background activity and to ignore battery optimizations, in turn granting the 
attacker continuous access to the infected device. Read more 

 > These are the best identity theft protection tools 


 > Malware found hiding disguised as Android security, VPN apps 


 > This dangerous Android malware could steal passwords and other data just 
by using images 

A second pop-up seeks permission to the devices accessibility features, and 
as such, information such as keystrokes. Other information that the threat 
actor can get access to includes a victims precise location, contacts, file 
storage, SMS messages, and call logs. 

The spyware is suspected to be a variant of Coverlm, which has previously 
been seen targeting data from apps like WhatsApp, Signal, and Telegram. The 
researchers also noted a similarity in the tactics seen in both this campaign 
and another by APT DoNot, both of which targeting the same geography and with 
a focus on espionage. 

Cyfirma says that, taking into account its findings, its analysis strongly 
indicates that the APT group behind the attack has ties to the Indian 
territory and is acting in the interest of one nation state government. 

When TechRadar Pro asked Google for more information about the previous DoNot 
attack, a company spokesperson confirmed that the malicious apps had been 
removed from the Play Store. 

We were also told that Google Play Protect protects users from apps known to 
contain this malware on Android devices with Google Play Services, even when 
those apps come from other sources." 

The company did not immediately respond to our request for comment specific 
to this example. In need of a cybersecurity boost? Consider the best firewalls



======================================================================
Link to news story:
https://www.techradar.com/pro/fake-android-chat-app-lets-hackers-steal-signal-
whatsapp-user-data


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.