BadBazaar Malware Attacking Android Users via Weaponized Telegram & Signal Apps

The Android BadBazaar malware is being distributed through the Google Play store, Samsung Galaxy Store, and dedicated websites mimicimg Signal Plus Messenger and FlyGram malicious applications.

These active campaigns are connected to the China-aligned APT organization known as GREF. Uyghurs and other Turkic ethnic minorities have historically been the target of the spyware known as BadBazaar.

The BadBazaar malware family has already been targeted, and the FlyGram malware was also observed being spread in a Uyghur Telegram channel.

According to ESET researchers, Germany, Poland, the U.S., Ukraine, Australia, Brazil, Denmark, Congo-Kinshasa, Hong Kong, Hungary, Lithuania, the Netherlands, Portugal, Singapore, Spain, and Yemen are the countries where victims have been found most often.

Specifics of the Attack

Researchers found active Android campaigns where malicious apps with the names Signal Plus Messenger and FlyGram were uploaded and disseminated through the Google Play store, Samsung Galaxy Store, and specific websites, imitating the Signal app (signalplus[.]org) and a Telegram alternative app (flygram[.]org).

The primary objective of BadBazaar is to steal device information such as the contact list, call logs, and the list of installed applications, as well as to spy on Signal conversations by secretly attaching the victim’s Signal Plus Messenger app to the attacker’s mobile device.

FlyGram can specifically extract not just sensitive data like contact lists, phone logs, and a list of Google Accounts but also basic device information. 

Additionally, the malware can exfiltrate some Telegram-related data and settings; researchers say this data excludes the Telegram contact list, messages, and any other sensitive data.

“If users enable a specific FlyGram feature that allows them to back up and restore Telegram data to a remote server controlled by the attackers, the threat actor will have full access to these Telegram backups, not only the collected metadata,” according to report shared with Cyber Security News.

Every newly created user account receives a special ID from the server. This ID has a sequential pattern, which shows that at least 13,953 FlyGram accounts have this feature turned on.

Similar device data and private information are gathered by Signal Plus Messenger, but its primary objective is to track the victim’s Signal communications.

It may obtain the Signal PIN that secures the Signal account and abuses the link device feature, which enables users to link Signal Desktop and Signal iPad to their phones.

“Malicious code from the BadBazaar family was hidden in trojanized Signal and Telegram apps, which should provide victims a working app experience (without reason to remove it) but with espionage happening in the background”, researchers said.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.