Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Craig Hale

Fake Android chat app lets hackers steal Signal, WhatsApp user data

Person holding down the power and volume down button on an Android phone

Experts have raised the alarm about yet another case of Android malware under the cover of a dodgy app, this time spreading across South Asian countries.

According to cybersecurity company Cyfirma, the “dummy chatting app” which goes by the name Safe Chat on victims’ devices is said to have higher levels of permissions compared with another similar instance of malware that it has been compared to.

After analyzing the malware, Cyfirma has revealed suspicions that the latest attack is yet another by Indian APT hacking group Bahamut.

Safe Chat app is… not safe

Once delivered via WhatsApp and installed, the Safe Chat app throws up a series of pop-up messages, including one asking the victim to allow background activity and to ignore battery optimizations, in turn granting the attacker continuous access to the infected device.

A second pop-up seeks permission to the device’s accessibility features, and as such, information such as keystrokes. Other information that the threat actor can get access to includes a victim’s precise location, contacts, file storage, SMS messages, and call logs.

The spyware is suspected to be a variant of Coverlm, which has previously been seen targeting data from apps like WhatsApp, Signal, and Telegram. The researchers also noted a similarity in the tactics seen in both this campaign and another by APT DoNot, both of which targeting the same geography and with a focus on espionage.

Cyfirma says that, taking into account its findings, its “analysis strongly indicates that the APT group behind the attack has ties to the Indian territory and is acting in the interest of one nation state government.”

When TechRadar Pro asked Google for more information about the previous DoNot attack, a company spokesperson confirmed that the malicious apps had been removed from the Play Store.

We were also told that “Google Play Protect protects users from apps known to contain this malware on Android devices with Google Play Services, even when those apps come from other sources."

The company did not immediately respond to our request for comment specific to this example.

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.