Earlier this month security researchers at ESET identified 12 Android espionage apps (spy apps) that share the same malicious code. All the reported apps claim to be messaging tools apart from one that poses as a news app. In the background, these apps secretly execute remote access trojan (RAT) code called VajraSpy, used for targeted espionage by the Patchwork APT group.
VajraSpy is said to have a range of espionage functionalities that can be expanded based on the permissions granted to the app bundled with its code.It steals contacts, files, call logs, and SMS messages. Some of these apps can also extract WhatsApp and Signal messages, record phone calls, and take pictures with the camera.
While ESET telemetry data registered detections from Malaysia only, the company believes that those were only incidental and did not constitute the actual targets of the campaign who are Android smartphone users in India and Pakistan. “We believe the victims were approached via a honey-trap romance scam where the campaign operators feigned romantic and/or sexual interest in their targets on another platform, and then convinced them to download these trojanized apps,” said the report.
Also Read | Explained: What is voice cloning scam and how you can avoid getting scammed
While 12 of these apps were on Google Play Store, others (those with Xamalicious) are on third-party app stores. While Google has removed all the apps, in case there are users who have downloaded any of these apps on their phones, they will have to delete them manually.
The apps that were available on Google Play are:
* Hello Chat
* Chit Chat
* Meet Me
* Nidus
* Rafaqat News
* Tik Talk
* Wave Chat
* Prive Talk
* Glow Glow
* Lets Chat
* NioNio
* Quick Chat
* Yoho Talk
Apps with Xamalicious
* Essential Horoscope for Android
* 3D Skin Editor for PE Minecraft
* Logo Maker Pro
* Auto Click Repeater
* Count Easy Calorie Calculator
* Sound Volume Extender
* LetterLink
* Numerology: Personal Horoscope & Number Predictions
* Step Keeper: Easy Pedometer
* Track Your Sleep
* Sound Volume Booster
* Astrological Navigator: Daily Horoscope & Tarot
* Universal Calculator
VajraSpy is said to have a range of espionage functionalities that can be expanded based on the permissions granted to the app bundled with its code.It steals contacts, files, call logs, and SMS messages. Some of these apps can also extract WhatsApp and Signal messages, record phone calls, and take pictures with the camera.
While ESET telemetry data registered detections from Malaysia only, the company believes that those were only incidental and did not constitute the actual targets of the campaign who are Android smartphone users in India and Pakistan. “We believe the victims were approached via a honey-trap romance scam where the campaign operators feigned romantic and/or sexual interest in their targets on another platform, and then convinced them to download these trojanized apps,” said the report.
Also Read | Explained: What is voice cloning scam and how you can avoid getting scammed
While 12 of these apps were on Google Play Store, others (those with Xamalicious) are on third-party app stores. While Google has removed all the apps, in case there are users who have downloaded any of these apps on their phones, they will have to delete them manually.
The apps that were available on Google Play are:
* Hello Chat
* Chit Chat
* Meet Me
* Nidus
* Rafaqat News
* Tik Talk
* Wave Chat
* Prive Talk
* Glow Glow
* Lets Chat
* NioNio
* Quick Chat
* Yoho Talk
Apps with Xamalicious
* Essential Horoscope for Android
* 3D Skin Editor for PE Minecraft
* Logo Maker Pro
* Auto Click Repeater
* Count Easy Calorie Calculator
* Sound Volume Extender
* LetterLink
* Numerology: Personal Horoscope & Number Predictions
* Step Keeper: Easy Pedometer
* Track Your Sleep
* Sound Volume Booster
* Astrological Navigator: Daily Horoscope & Tarot
* Universal Calculator
Denial of responsibility! Swift Telecast is an automatic aggregator of the all world’s media. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, all materials to their authors. If you are the owner of the content and do not want us to publish your materials, please contact us by email – swifttelecast.com. The content will be deleted within 24 hours.