Android malware

Hackers are using a fake Android app named 'SafeChat' to infect devices with spyware malware that steals call logs, texts, and GPS locations from phones.

The Android spyware is suspected to be a variant of "Coverlm," which steals data from communication apps such as Telegram, Signal, WhatsApp, Viber, and Facebook Messenger.

CYFIRMA researchers say the Indian APT hacking group 'Bahamut' is behind the campaign, with their latest attacks conducted mainly through spear phishing messages on WhatsApp that send the malicious payloads directly to the victim.

Also, the CYFIRMA's analysts highlight several TTP similarities to another Indian state-sponsored threat group, the 'DoNot APT' (APT-C-35), that has previously infested Google Play with fake chat apps acting as spyware.

Late last year, ESET reported that the Bahamut group was using fake VPN apps for the Android platform that included extensive spyware functions.

In the latest campaign observed by CYFIRMA, Bahamut targets individuals in South Asia.

"Safe Chat" details

While CYFIRMA doesn't delve into the specifics of the social engineering aspect of the attack, it's common for victims to be persuaded into installing a chat app under the pretext of transitioning the conversation to a more secure platform.

The analysts report that Safe Chat features a deceiving interface that makes it appear as a real chat app and also takes the victim through a seemingly legitimate user registration process that adds credibility and serves as an excellent cover for the spyware.

Safe Chat's sign up screen
Safe Chat's sign up screen (CYFIRMA)

One critical step in the infection is the acquisition of permissions to use the Accessibility Services, which are subsequently abused to automatically grant the spyware more permissions.

These additional permissions enable the spyware to access to the victim's contacts list, SMS, call logs, external device storage, and fetch precise GPS location data from the infected device.

All permissions included in the spyware's manifest file
All permissions included in the spyware's manifest file (CYFIRMA)

The app also requests the user to approve exclusion from Android's battery optimization subsystem, which terminates background processes when the user isn't actively engaging with the app.

"Another snippet from the Android Manifest file shows that the threat actor designed the app to interact with other already installed chat applications," explains CYFIRMA.

"The interaction will take place using intents, OPEN_DOCUMENT_TREE permission will select specific directories and access apps mentioned in intent."

Module that monitors other chat apps on the device
Module that monitors other chat apps on the device (CYFIRMA)

A dedicated data exfiltration module transfers information from the device to the attacker's C2 server through port 2053.

The stolen data is encrypted using another module that supports RSA, ECB, and OAEPPadding. At the same time, the attackers also use a "letsencrypt" certificate to evade any network data interception efforts against them.

CYFIRMA concludes the report by saying that it holds enough evidence to link Bahamut to working on behalf of a specific state government in India.

Also, using the same certificate authority as the DoNot APT group, similar data stealing methodologies, common targeting scope, and the use of Android apps to infect targets all indicate overlap or close collaboration between the two groups.

Update 8/4 - A Google spokesperson has sent BleepingComputer the following comment:

Users are protected by Google Play Protect, which can warn users of identified malicious apps on Android devices.

Related Articles:

Android 15, Google Play Protect get new anti-malware and anti-fraud features

Google Pixel 6 series phones bricked after factory reset

Snowblind malware abuses Android security feature to bypass security

New Medusa malware variants target Android users in seven countries

Chrome for Android tests feature that securely verifies your ID with sites