Security News > 2023 > September > Millions Infected by Spyware Hidden in Fake Telegram Apps on Google Play

Spyware masquerading as modified versions of Telegram have been spotted in the Google Play Store that's designed to harvest sensitive information from compromised Android devices.

The apps have been collectively downloaded millions of times before they were taken down by Google.

It's worth noting that the package name associated with the Play Store version of Telegram is "Org.telegram.messenger," whereas the package name for the APK file directly downloaded from Telegram's website is "Org.telegram.messenger.web."

"At first glance, these apps appear to be full-fledged Telegram clones with a localized interface," the company said.

The disclosure comes days after ESET revealed a BadBazaar malware campaign targeting the official app marketplace that leveraged a rogue version of Telegram to amass chat backups.

Similar copycat Telegram and WhatsApp apps were uncovered by the Slovak cybersecurity company previously in March 2023 that came fitted with clipper functionality to intercept and modify wallet addresses in chat messages and redirect cryptocurrency transfers to attacker-owned wallets.

News URL

https://thehackernews.com/2023/09/millions-infected-by-spyware-hidden-in.html