Wednesday, April 17, 2024

BadBazaar Malware Attacking Android Users via Weaponized Telegram & Signal Apps

The Android BadBazaar malware is being distributed through the Google Play store, Samsung Galaxy Store, and dedicated websites mimicimg Signal Plus Messenger and FlyGram malicious applications.

These active campaigns are connected to the China-aligned APT organization known as GREF. Uyghurs and other Turkic ethnic minorities have historically been the target of the spyware known as BadBazaar.

The BadBazaar malware family has already been targeted, and the FlyGram malware was also observed being spread in a Uyghur Telegram channel.

According to ESET researchers, Germany, Poland, the U.S., Ukraine, Australia, Brazil, Denmark, Congo-Kinshasa, Hong Kong, Hungary, Lithuania, the Netherlands, Portugal, Singapore, Spain, and Yemen are the countries where victims have been found most often.

Specifics of the Attack

Researchers found active Android campaigns where malicious apps with the names Signal Plus Messenger and FlyGram were uploaded and disseminated through the Google Play store, Samsung Galaxy Store, and specific websites, imitating the Signal app (signalplus[.]org) and a Telegram alternative app (flygram[.]org).

The primary objective of BadBazaar is to steal device information such as the contact list, call logs, and the list of installed applications, as well as to spy on Signal conversations by secretly attaching the victim’s Signal Plus Messenger app to the attacker’s mobile device.

BadBazaar Figure_01
Signal Plus Messenger is available on Google Play (left) and Samsung Galaxy Store (right)

FlyGram can specifically extract not just sensitive data like contact lists, phone logs, and a list of Google Accounts but also basic device information. 

Additionally, the malware can exfiltrate some Telegram-related data and settings; researchers say this data excludes the Telegram contact list, messages, and any other sensitive data.

“If users enable a specific FlyGram feature that allows them to back up and restore Telegram data to a remote server controlled by the attackers, the threat actor will have full access to these Telegram backups, not only the collected metadata,” according to report shared with Cyber Security News.

Linking the victim’s Signal communications to the attacker

Every newly created user account receives a special ID from the server. This ID has a sequential pattern, which shows that at least 13,953 FlyGram accounts have this feature turned on.

Similar device data and private information are gathered by Signal Plus Messenger, but its primary objective is to track the victim’s Signal communications.

It may obtain the Signal PIN that secures the Signal account and abuses the link device feature, which enables users to link Signal Desktop and Signal iPad to their phones.

“Malicious code from the BadBazaar family was hidden in trojanized Signal and Telegram apps, which should provide victims a working app experience (without reason to remove it) but with espionage happening in the background”, researchers said.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

In today's digital landscape, email security has become a critical concern for businesses of...

Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

In a digital age where information is the new currency, the recent global hack...

Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges

Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange's smart contract by injecting fabricated...

Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information

Omni Hotels & Resorts has revealed that it was the target of a recent...

Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS

A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.Dubbed...

TA558 Hackers Compromised 320+ Organizations’ FTP & SMTP Servers

TA558, a financially motivated threat actor identified in 2018, is targeting several countries but...

Blackjack Hackers Destroyed 87,000 Sensors Using Lethal ICS Malware

A group of cybercriminals known as "Blackjack" has launched a devastating attack on industrial...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles