New China-linked spyware targets Android users via fake Signal, Telegram apps

Cybersecurity researchers have discovered malicious Signal and Telegram Android apps distributed via the Google Play Store and Samsung Galaxy Store designed to deliver the China-linked “BadBazaar” spyware, a new report has revealed.

According to cybersecurity company ESET, the threat actors behind the malicious tool are the China-aligned APT group GREF.

The malicious Signal and Telegram apps hackers were using to infect users’ devices are ‘Signal Plus Messenger’ and ‘FlyGram’.

“Most likely active since July 2020 and since July 2022, respectively, the campaigns have distributed the Android BadBazaar espionage code through the Google Play store, Samsung Galaxy Store, and dedicated websites representing the malicious apps Signal Plus Messenger and FlyGram,” said security researcher Lukas Stefanko.

The purpose of these trojanized apps is to exfiltrate user data. Specifically, FlyGram can extract basic device information, but also sensitive data, such as contact lists, call logs, and the list of Google Accounts.

FlyGram can access Telegram backups if the user enabled a specific feature added by the attackers; the feature was activated by at least 13,953 user accounts, the report said.

Signal Plus Messenger collects similar device data andsensitive information; however, its main goal is to spy on the victim’s Signal communications – it can extract the Signal PIN number that protects the Signal account and abuses the link device feature that allows users to connect Signal Desktop and Signal iPad to their phones.

Previously, the BadBazaar malwarewas used to target Uyghurs and other Turkic ethnic minorities.

FlyGram malware was also seen shared in a Uyghur Telegram group, which aligns with previous targeting of the BadBazaar malware family, according to the report.

Victims have been found primarily in Germany, Poland, and the US, with victims also discovered in Ukraine, Australia, Brazil, Denmark, Congo-Kinshasa, Hong Kong, Hungary, Lithuania, the Netherlands, Portugal, Singapore, Spain, and Yemen.

“Both Signal Plus Messenger and FlyGram are slightly different variants of BadBazaar that focus on user data exfiltration and espionage. However, it’s important to note that each of them possesses unique malicious functionalities,” Stefanko said.

(With inputs from IANS)