Hackers are using a fake Android app called “SafeChat” to infect devices with malicious spyware. This malware steals call logs, text messages, and GPS locations from phones.
See also: Signal: Users can customize how Stories are published
There are suspicions that the spyware affecting Android is a variant of “Coverlm”, which extracts data from communication apps such as Telegram, Signal, WhatsApp, Viber and Facebook Messenger.
CYFIRMA researchers report that the hacking group called “Bahamut” is allegedly responsible for the campaign, with its most recent attacks focusing primarily on spear phishing messages on WhatsApp, through which malicious payloads are sent directly to victims.
Additionally, CYFIRMA analysts point out several similarities to another Indian state-sponsored threat group known as “DoNot APT” (APT-C-35). In the past, the group has infected Google Play with fake chat apps that act as spyware.
Late last year, ESET reported that the Bahamut group was using fake VPN for the Android platform that contained extensive tracking features. In the most recent campaign observed by CYFIRMA, Bahamut is targeting individuals in South Asia.
While CYFIRMA did not elaborate on the details of the attack, it is common for victims to be convinced to install a chat app under the guise of migrating their chat to a more secure platform. Analysts say SafeChat has a deceptive interface that makes it look like a real chat app. It also guides the victim through a seemingly legitimate user registration process, lending credibility and acting as a better cover for the spyware.
See also: How to mute calls from unknown callers on WhatsApp
A critical step in preventing infection is obtaining permissions to use Accessibility Services, which are then used to automatically grant more permissions to the spyware. These additional permissions allow the malware to access the contact list, SMS messages, call logs, external storage, and obtain precise GPS from the infected device.
Additionally, the fake SafeChat app asks the user to allow an opt-out from Android's battery optimization subsystem. This subsystem terminates background processes when the user is not actively engaged with the app.
A dedicated data extraction module transfers information from the device to the attacker's C2 server via port 2053. A specialized data recovery mechanism transfers information from the device to the attacker, using port 2053. This process effectively secures the transfer of data between the two devices.
The stolen data is encrypted using another module that supports RSA, ECB, and OAEPPadding. This ensures the integrity of the data during encryption. At the same time, the attackers also use a “letsencrypt” certificate to avoid possible attempts to intercept network data on their side.
CYFIRMA concludes that it has a wealth of evidence linking Bahamut to working on behalf of a specific state government in India. In addition, the implementation of the same certificate authority as the DoNot APT, the use of similar data theft methodologies, the broad focus on targets, and the use of Android apps to infect suggest collaboration or a close relationship between the two groups.
See also: How to chat on WhatsApp without saving the number
The attack highlights the importance of caution when downloading apps and granting permissions to Android devices. Users are advised to only download apps from official app stores and verify app permissions before granting access to sensitive data. Regularly updating devices with the latest security patches is also crucial to preventing such attacks. Additionally, being vigilant and aware of potential phishing attempts and suspicious activity can help users protect their data and privacy from malicious actors.
