(MENAFN- IANS) New Delhi, Sep 4 (IANS) Cybersecurity researchers have discovered maliciSignal and Telegram Android apps distributed via the google Play Store and Samsung Galaxy Store designed to deliver the China-linked "BadBazaar" spyware, a new report has revealed. According to cybersecurity company ESET, the threat actors behind the malicitool are the China-aligned APT group GREF.
The maliciSignal and Telegram apps hackers were using to infect users' devices are 'Signal PMessenger' and 'FlyGram'.
"Most likely active since July 2020 and since July 2022, respectively, the campaigns have distributed the Android BadBazaar espionage code through the Google Play store, Samsung Galaxy Store, and dedicated websites representing the maliciapps Signal PMessenger and FlyGram," said security researcher Lukas Stefanko.
The purpose of these trojanized apps is to exfiltrate user data. Specifically, FlyGram can extract basic device information, but also sensitive data, such as contact lists, call logs, and the list of Google Accounts.
FlyGram can access Telegram backups if the user enabled a specific feature added by the attackers; the feature was activated by at least 13,953 user accounts, the report said.
Signal PMessenger collects similar device data and sensitive information; however, its main goal is to spy on the victim's Signal communications - it can extract the Signal PIN number that protects the Signal account and abuses the link device feature that allows users to connect Signal Desktop and Signal iPad to their phones.
Previously, the BadBazaar malware was used to target Uyghurs and other Turkic ethnic minorities.
FlyGram malware was also seen shared in a Uyghur Telegram group, which aligns with previtargeting of the BadBazaar malware family, according to the report.
Victims have been found primarily in Germany, Poland, and the US, with victims also discovered in Ukraine, Australia, Brazil, Denmark, Congo-Kinshasa, Hong Kong, Hungary, Lithuania, the Netherlands, Portugal, Singapore, Spain, and Yemen.
"Both Signal PMessenger and FlyGram are slightly different variants of BadBazaar that foon user data exfiltration and espionage. However, it's important to note that each of them possesses unique malicifunctionalities," Stefanko said.
--IANS
shs/ksk