Bahamut uses fake chat app to steal data

Share post:

CYFIRMA researchers have warned that an Indian APT hacking group ‘Bahamut’ is using a fake Android app called “SafeChat” to infect devices with spyware malware that steals call logs, texts, and GPS locations from phones.

The Android spyware is suspected to be a variant of “Coverlm,” which steals data from communication apps such as Telegram, Signal, WhatsApp, Viber, and Facebook Messenger. And the attack is conducted mainly through spear phishing messages on WhatsApp that send the malicious payloads directly to the victim.

Safe Chat features a deceiving interface that makes it appear as a real chat app and also takes the victim through a seemingly legitimate user registration process that adds credibility and serves as an excellent cover for the spyware. It then acquires permissions to use the Accessibility Services, which are subsequently abused to automatically grant the spyware more permissions.

These additional permissions enable the spyware to access to the victim’s contacts list, SMS, call logs, external device storage, and fetch precise GPS location data from the infected device. The app also requests the user to approve exclusion from Android’s battery optimization subsystem, which terminates background processes when the user isn’t actively engaging with the app.

A dedicated data exfiltration module transfers information from the device to the attacker’s C2 server through port 2053. The stolen data is encrypted using another module that supports RSA, ECB, and OAEPPadding. At the same time, the attackers also use a “letsencrypt” certificate to evade any network data interception efforts against them.

CYFIRMA concludes the report by saying that it holds enough evidence to link Bahamut to working on behalf of a specific state government in India.

The sources for this piece include an article in BleepingComputer.


Related articles

Costs from Global CrowdStrike Outage Could Exceed $1 Billion

The global tech outage caused by a faulty CrowdStrike update on Friday could result in damages exceeding $1...

CrowdStrike update: Warnings from national cyber agencies, repair options from Microsoft

National cybersecurity agencies in the U.S., Canada, the U.K. and Australia issued security warnings about the faulty CrowdStrike...

CrowdStrike update causes global IT outages, fix is available

Some airlines, banks and government services around the world have been affected by a faulty software update for...

Charges dismissed in SolarWinds hacking case

A judge has dismissed most of the Securities and Exchange Commission's (SEC) fraud charges against SolarWinds related to...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways