Fake Android chat app lets hackers steal Signal, WhatsApp user data

Experts have raised the alarm about yet another case of Android malware under the cover of a dodgy app, this time spreading across South Asian countries.

According to cybersecurity company Cyfirma, the “dummy chatting app” which goes by the name Safe Chat on victims’ devices is said to have higher levels of permissions compared with another similar instance of malware that it has been compared to.

After analyzing the malware, Cyfirma has revealed suspicions that the latest attack is yet another by Indian APT hacking group Bahamut.

Safe Chat app is… not safe

Once delivered via WhatsApp and installed, the Safe Chat app throws up a series of pop-up messages, including one asking the victim to allow background activity and to ignore battery optimizations, in turn granting the attacker continuous access to the infected device.

A second pop-up seeks permission to the device’s accessibility features, and as such, information such as keystrokes. Other information that the threat actor can get access to includes a victim’s precise location, contacts, file storage, SMS messages, and call logs.

The spyware is suspected to be a variant of Coverlm, which has previously been seen targeting data from apps like WhatsApp, Signal, and Telegram. The researchers also noted a similarity in the tactics seen in both this campaign and another by APT DoNot, both of which targeting the same geography and with a focus on espionage.

Cyfirma says that, taking into account its findings, its “analysis strongly indicates that the APT group behind the attack has ties to the Indian territory and is acting in the interest of one nation state government.”

When TechRadar Pro asked Google for more information about the previous DoNot attack, a company spokesperson confirmed that the malicious apps had been removed from the Play Store.

We were also told that “Google Play Protect protects users from apps known to contain this malware on Android devices with Google Play Services, even when those apps come from other sources.”

The company did not immediately respond to our request for comment specific to this example.

In need of a cybersecurity boost? Consider the best firewalls