Sunday, June 15, 2025
HomespywarePJobRAT Disguised as Android Dating App Steals Contacts, SMS & GPS data

PJobRAT Disguised as Android Dating App Steals Contacts, SMS & GPS data

Published on

SIEM as a Service

Follow Us on Google News

In the recent era, hackers are constantly evolving and using their techniques to execute new attack vectors to target users from different sectors across the globe, as reported by the security researchers at Cyble.

The spyware campaign that currently uncovered mainly targeting the Indian military personnel, and since January 2021 this campaign has been active.

The cybersecurity experts of Cyble along with 360 Core Security Lab have recently detected the PJobRAT spyware in dating and instant messaging apps. Not only that even, the analysts have also claimed that the spyware samples disguised themselves as Android dating apps.

- Advertisement - Google News

Since December 2019 the recent version of PJobRAT spyware has been around, as reported by the researchers at 360 Core Security Lab.

While during their investigation they detected that for Non-resident Indians this recent variant is disguising as a famous dating app known as “Trendbanter,” and mimicking the instant messaging app, Signal as well.

Data collected by PJobRAT via fake apps

  • Contacts
  • SMSes
  • GPS data

Other apps used

In some cases, the researchers have identified that it also imitate other apps as well, and here they are mentioned below:-

  • HangOn
  • SignalLite
  • Rita
  • Ponam

Moreover, through different medium and third-party app stores, the threat actors accomplish their distribution goals in which they distribute all these spyware.

While the experts have asserted that to hide in the app list, it imitates WhatsApp or any genuine-looking app. But, the most bizarre thing is that it doesn’t even match the icon shown in the app store with the installed one.

Types of Documents it Exfiltrates

The types of documents that it able to exfiltrate from the infected device are mentioned below:-

  • .pdf
  • .doc
  • .docx
  • .xls
  • .xlsx
  • .ppt
  • .pptx

The complete list of abilities of PJobRAT spyware is mentioned below:-

  • Upload address book
  • Upload SMS
  • Upload audio files
  • Upload video file
  • Upload image file
  • Upload a list of installed apps
  • Upload a list of external storage files
  • Upload WiFi and GPS information 
  • Upload geographic location
  • Update phone number
  • Recording via the mic or camera
  • Upload WhatsApp contacts and messages

In terms of its code, the spyware remains the same, and not only that even it also interacts with the same infrastructure as well. 

But, the analysts have affirmed that the threat actors behind this spyware are not so sophisticated, since their private servers are publicly accessible in which they hold the exfiltrated data.

The security researchers at 360 Core Security Lab has concluded that the threat actors behind PJobRAT spyware could be Chinese or Pakistani hackers, and that’s why their primary goal was to spy on Indian military personnel.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Graphite Spyware Uses iOS Zero-Click Flaw to Target Journalists

Security researchers at Citizen Lab have uncovered the first forensic evidence linking Paragon’s Graphite...

NSO Group Ordered to Pay $168 Million to WhatsApp in US Spyware Verdict

A federal jury in California has ordered Israeli spyware maker NSO Group to pay...

New Android Spyware Tricks Users by Demanding Passwords for Uninstallation

A newly identified Android spyware app is elevating its tactics to remain hidden and...