ESET researchers have identified an updated version of Android GravityRAT spyware being distributed as the messaging apps BingeChat and Chatico. GravityRAT is a remote access tool known to be used since at least 2015 and previously used in targeted attacks against India. Windows, Android, and macOS versions are available, as previously documented by Cisco Talos, Kaspersky, and Cyble. The actor behind GravityRAT remains unknown; we track the group internally as SpaceCobra.
Most likely active since August 2022, the BingeChat campaign is still ongoing; however, the campaign using Chatico is no longer active. BingeChat is distributed through a website advertising free messaging services. Notable in the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive commands to delete files. The malicious apps also provide legitimate chat functionality based on the open-source OMEMO Instant Messenger app.
By infosecbulletin
/ Saturday , February 15 2025
Xploit_Cr3w and Blind_Virus are the two champion teams categorically for BCS ICT Fest 2025 arranged jointly by BCS and BUET....
Read More
By infosecbulletin
/ Friday , February 14 2025
Between December 2024 and January 2025, Recorded Future's Insikt Group discovered a campaign targeting unpatched Cisco devices used by major...
Read More
By infosecbulletin
/ Friday , February 14 2025
On February 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued 20 advisories about serious vulnerabilities in Industrial Control...
Read More
By infosecbulletin
/ Friday , February 14 2025
The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses...
Read More
By infosecbulletin
/ Thursday , February 13 2025
A sophisticated malware campaign is targeting military and government entities in Bangladesh. It uses social engineering to deliver malicious files...
Read More
By infosecbulletin
/ Thursday , February 13 2025
CrowdStrike has issued a security advisory for a serious TLS vulnerability, CVE-2025-1146, in its Falcon Sensor for Linux, Falcon Kubernetes...
Read More
By infosecbulletin
/ Thursday , February 13 2025
Palo Alto Networks has issued advisories for two critical vulnerabilities in its PAN-OS. The vulnerabilities, CVE-2025-0108 and CVE-2025-0110, may enable...
Read More
By infosecbulletin
/ Thursday , February 13 2025
Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC)...
Read More
By infosecbulletin
/ Wednesday , February 12 2025
Last year, a joint investigation revealed that a Florida-based data broker, Datastream Group, was selling highly sensitive location data that...
Read More
By infosecbulletin
/ Wednesday , February 12 2025
In 2024, Intel addressed a remarkable 374 vulnerabilities across its software, firmware, and hardware products, distributing bug bounty rewards for...
Read More
The creation of WhatsApp backups is intended to facilitate the migration of users’ message history, media files, and data to different or new devices.
While it’s crucial to be aware that these backups may include unencrypted sensitive data like:-
- Text
- Video
- Photos
- Documents
Key points:
- A new version of Android GravityRAT spyware being distributed as trojanized versions of the legitimate open-source OMEMO Instant Messenger Android app.
- The trojanized BingeChat app is available for download from a website that presents it as a free messaging and file sharing service.
- This version of GravityRAT is enhanced with two new capabilities: receiving commands to delete files and exfiltrating WhatsApp backup files.