Saturday, July 13, 2024

Android GravityRAT Spyware Steals WhatsApp Backup Files

Since August 2022, a recently discovered Android virus named “GravityRAT” has rapidly circulated through a new Android malware campaign. 

It gains access to phones by disguising itself as a fraudulent chat app called ‘BingeChat‘ in order to steal users’ sensitive data.


ESET researcher Lukas Stefanko discovered that the latest version of GravityRAT now steals WhatsApp backup files.

The creation of WhatsApp backups is intended to facilitate the migration of users’ message history, media files, and data to different or new devices.

While it’s crucial to be aware that these backups may include unencrypted sensitive data like:-

  • Text
  • Video
  • Photos
  • Documents

Technical analysis

Since 2015, GravityRAT has been active and in operation, but it shifted its focus to Android devices in 2020 for the very first time.

The spyware is exclusively utilized by ‘SpaceCobra,’ its operators, for selected operations with specific targets.

The spyware disguises itself as a chat application called ‘BingeChat,’ which claims to offer:-

  • End-to-end encryption
  • A user-friendly interface
  • Advanced functionalities
powerful features

The delivery of the app occurs through the website “bingechat[.]net” or other available platforms.

However, downloading it requires an invitation, prompting visitors to register a new account or provide sensitive data like credentials.


Presently, registrations are closed, and this method is employed solely for the purpose of targeting specific people with the distribution of malicious apps.

In 2021, the operators of GravityRAT once again employed the tactic of promoting malicious Android APKs to their targets.

This time, they utilized a chat app called ‘SoSafe,’ while a previous app named ‘Travel Mate Pro‘ was used before that.

Stefanko discovered that the app is a modified version of OMEMO IM, which is an authentic open-source instant messaging application for Android but is now infused with a trojan.

It was revealed by an ESET analyst that SpaceCobra employed a fraudulent app called “Chatico.”

This app was distributed to targeted individuals through the website “[.]uk” during the summer of 2022.

Permissions asked

Upon installation on the target’s device, BingeChat requests permissions that pose potential risks. The permissions include access to the following:-

  • Contacts
  • Location
  • Phone
  • SMS
  • Storage
  • Call logs
  • Camera
  • Microphone

As instant messaging apps commonly require these permissions, they are unlikely to trigger suspicion or seem strange to the targeted individual.

When a user attempts to register on BingeChat, the app transfers the following details automatically to a C2 server operated by the threat actor:-

  • Call logs
  • Contact lists
  • SMS messages
  • Device location
  • Basic device information

As a safety measure, it is advised that users must avoid downloading any APKs from other unknown or unreliable sources.

Additionally, it is important to exercise caution and be vigilant regarding app permissions during installation.

Looking For an All-in-One Multi-OS Patch Management Platform – 


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles