{"id":506232,"date":"2023-08-31T15:29:28","date_gmt":"2023-08-31T13:29:28","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=506232"},"modified":"2023-08-31T15:38:39","modified_gmt":"2023-08-31T13:38:39","slug":"attackers-spread-malware-through-play-store-listed-trojanized-telegram-and-signal-apps","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/506232-attackers-spread-malware-through-play-store-listed-trojanized-telegram-and-signal-apps.html","title":{"rendered":"Attackers spread malware through Play Store-listed trojanized Telegram and Signal apps"},"content":{"rendered":"

ESET researcher Lukas Stefanko discovered trojanized Telegram and Signal apps<\/a><\/strong> distributing the BadBazaar spyware through the Google Play Store and Samsung Galaxy Store.<\/p>\n

The malware \u2014 uploaded by the Chinese APT hacking group GREF \u2014 has previously been used to target minorities in China.<\/p>\n

However, ESET’s data shows they now target users in Ukraine, Poland, the Netherlands, Spain, Portugal, Germany, Hong Kong, and the United States.<\/p>\n

The malware can provide precise device location information, steal call logs and SMS, record phone calls, take pictures through the smartphone’s camera, export contact lists, and steal files or databases.<\/p>\n

The Android apps that distribute the malware are called “Signal Plus Messenger” and “FlyGram”.<\/p>\n

The malicious actors also created dedicated websites for the apps \u2014 signalplus.org and flygram.org \u2014 to make them seemingly more legitimate by offering direct download links and links to the Google Play Store.<\/p>\n

FlyGram targets private data like contact lists, call logs, Google accounts, and Wi-Fi data while offering a backup feature that sends Telegram communication data to a server the attackers own.<\/p>\n

ESET’s analysis revealed that more than 13,950 FlyGram users enabled the backup. However, the total number of users who downloaded the app remains unknown.<\/p>\n

Signal Plus Messenger targets similar information, with a focus on extracting Signal communication data and the PIN that protects users’ accounts.<\/p>\n

It also bypasses the QR-code-based device linking feature offered by Signal to link an attacker-controlled device to users’ accounts.<\/p>\n

“BadBazaar, the malware responsible for the spying, bypasses the usual QR code scan and user click process by receiving the necessary URI from its C&C server, and directly triggering the necessary action when the Link device button is clicked,” says ESET.<\/p>\n

“This enables the malware to secretly link the victim’s smartphone to the attacker’s device, allowing them to spy on Signal communications without the victim’s knowledge.”<\/p>\n

However, users can confirm if unknown devices are linked to their account by launching the real Signal app, going to Settings, and selecting the “Linked Devices” option.<\/p>\n

From there, they can view and manage linked devices.<\/p>\n

\n

Now read: FBI takes down massive botnet<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

The malware can provide precise device location information, steal call logs and SMS, record phone calls, take pictures through the smartphone’s camera, export contact lists, and steal files or databases.<\/p>\n","protected":false},"author":341076,"featured_media":479631,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[88998,9557,89000,89002,801,30082,23753,10484],"class_list":["post-506232","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-badbazaar","tag-google-play-store","tag-gref","tag-lukas-stefanko","tag-malware","tag-signal","tag-telegram","tag-trojan"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/506232"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341076"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=506232"}],"version-history":[{"count":0,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/506232\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/479631"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=506232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=506232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=506232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}