Deployed massively in Southeast Asia, a messaging application called SafeChat is actually malware that siphons off all the data contained in other apps of its kind such as WhatsApp, Telegram or Facebook Messenger.
The fight against malware on Android is endless. Every time Google takes a step forward in protecting users, hackers find a way around it. They can no longer distribute their infected application on the Play Store? No problem, they will directly provide a download link via instant messaging. This was discovered by the cybersecurity firm CYFERMA. A major campaign has been launched in Southeast Asia by the Indian hacker group known as Bahamut.
In a WhatsApp conversation, they send a link to download another supposedly more secure messenger, SafeChat. Once installed, it opens to a page asking to exclude the app from the Android battery optimization system, which stops background processes. It seems legitimate since activating it for messaging can delay or prevent the arrival of messages. The victim then creates an account and must authorize access to the accessibility options. From there, the hackers rush into the mobile.
FAKE SAFECHAT APP STEALS DATA FROM SECURE ANDROID MESSAGING
The malware used was identified as being similar to Coverlm, already used by the Bahamut group. Before the user becomes aware of the deception, the malicious program reads and recovers GPS data, the directory, the external memory, the SMS, the call log... But that's not all: it accesses the other messaging applications installed on the mobile, even secure ones. WhatsApp, Messenger, Signal or Telegram are not immune.
All the information collected is then sent to hackers. For the moment, the threat seems confined to Southeast Asia, but it is not certain that it does not extend outside. Remember to be extremely careful when installing Android apps outside of the official Google Play Store, especially when you are not the one initiating the process.
Comments
Post a Comment