Security News > 2021 > November > Fake end-to-end encrypted chat app distributes Android spyware

The GravityRAT remote access trojan is being distributed in the wild again, this time under the guise of an end-to-end encrypted chat application called SoSafe Chat.

In 2020, the malware was targeting people via an Android app named 'Travel Mate Pro,' but since the pandemic has slowed down traveling, the actors moved to a new guise.

The app is now called 'SoSafe Chat' and is promoted as a secure messaging application that features end-to-end encryption.

Once installed on a target's device, the spyware can perform a wide range of malicious behavior, allowing the threat actors to exfiltrate data, spy on the victim, and track their location.

Read current cellular network information, the phone number and the serial number of the victim's phone, the status of any ongoing calls, and a list of any Phone Accounts registered on the device.

Before the 2020 version, GravityRAT would exclusively target Windows machines, not having the ability to infect mobile devices.

News URL

https://www.bleepingcomputer.com/news/security/fake-end-to-end-encrypted-chat-app-distributes-android-spyware/