A new report has revealed the discovery of a malicious Signal and Telegram Android apps distributed via Google Play Store and Samsung Galaxy Store designed to deliver a China-linked “BadBazaar” spyware. According to cybersecurity researchers at ESET, persons behind the malicious tool are the China-aligned Advanced Persistent Threat (APT) group known as GREF, who used fake versions of popular messaging apps Signal and Telegram called ‘Signal Plus Messenger’ and “FlyGram’ to infect users’ devices.
“Most likely active since July 2020 and July 2022, respectively, the campaigns have distributed the Android BadBazaar espionage code through Google Play store, Samsung Galaxy store, and dedicated websites representing the malicious apps Signal Plus Messenger and FLyGram,” said security researcher Lukas Stefanko.
These trojanized apps exfiltrate user sensitive data and has the ability to remotely control infected devices and access other sensitive information. Specifically, FlyGram can extract basic device information, but also sensitive data, such as contact lists, call logs, and the list of Google Accounts.
FlyGram can access Telegram backups if the user enabled a specific feature added by the attackers; the feature was activated by at least 13,953 user accounts, the report said.
Signal Plus Messenger collects similar device data and sensitive information; however, its main goal is to spy on the victim's Signal communications, it can extract the Signal PIN number that protects the Signal account and abuses the link device feature that enable users to connect Signal Desktop and Signal iPad to their phones.
What makes these spywares particularly concerning is their deceptive nature. The fake apps closely resemble the legitimate Signal and Telegram apps, making it difficult for users to detect that they have been compromised. Users are advised to only download apps from official sources or the official websites of respective apps.
