Fake Android chat app lets hackers steal Signal, WhatsApp user data

Person holding down the power and volume down button on an Android phone
(Image credit: Future)

Experts have raised the alarm about yet another case of Android malware under the cover of a dodgy app, this time spreading across South Asian countries.

According to cybersecurity company Cyfirma, the “dummy chatting app” which goes by the name Safe Chat on victims’ devices is said to have higher levels of permissions compared with another similar instance of malware that it has been compared to.

After analyzing the malware, Cyfirma has revealed suspicions that the latest attack is yet another by Indian APT hacking group Bahamut.

Safe Chat app is… not safe

Once delivered via WhatsApp and installed, the Safe Chat app throws up a series of pop-up messages, including one asking the victim to allow background activity and to ignore battery optimizations, in turn granting the attacker continuous access to the infected device.

A second pop-up seeks permission to the device’s accessibility features, and as such, information such as keystrokes. Other information that the threat actor can get access to includes a victim’s precise location, contacts, file storage, SMS messages, and call logs.

The spyware is suspected to be a variant of Coverlm, which has previously been seen targeting data from apps like WhatsApp, Signal, and Telegram. The researchers also noted a similarity in the tactics seen in both this campaign and another by APT DoNot, both of which targeting the same geography and with a focus on espionage.

Cyfirma says that, taking into account its findings, its “analysis strongly indicates that the APT group behind the attack has ties to the Indian territory and is acting in the interest of one nation state government.”

When TechRadar Pro asked Google for more information about the previous DoNot attack, a company spokesperson confirmed that the malicious apps had been removed from the Play Store.

We were also told that “Google Play Protect protects users from apps known to contain this malware on Android devices with Google Play Services, even when those apps come from other sources."

A company spokesperson confirmed in an email to TechRadar Pro that users are also protected by Google Play Protect in the case of the Safe Chat app.

Craig Hale

With several years’ experience freelancing in tech and automotive circles, Craig’s specific interests lie in technology that is designed to better our lives, including AI and ML, productivity aids, and smart fitness. He is also passionate about cars and the decarbonisation of personal transportation. As an avid bargain-hunter, you can be sure that any deal Craig finds is top value!