Millions Infected by Spyware Hidden in Fake Telegram Apps on Google Play

Spyware masquerading as modified variations of Telegram have been noticed in the Google Play Store which is made to harvest sensitive data from compromised Android gadgets.

In accordance to Kaspersky security researcher Igor Golovin, the applications appear with nefarious functions to capture and exfiltrate names, user IDs, contacts, phone figures, and chat messages to an actor-controlled server.

The action has been codenamed Evil Telegram by the Russian cybersecurity organization.

The applications have been collectively downloaded tens of millions of situations right before they have been taken down by Google. Their facts are as follows –

• 電報,紙飛機-TG繁體中文版 or 電報,小飛機-TG繁體中文版 (org.telegram.messenger.wab) – 10 million+ downloads
• TG繁體中文版-電報,紙飛機 (org.telegram.messenger.wab) – 50,000+ downloads
• 电报,纸飞机-TG简体中文版 (org.telegram.messenger.wob) – 50,000+ downloads
• 电报,纸飞机-TG简体中文版 (org.tgcn.messenger.wob) – 10,000+ downloads
• ئۇيغۇر تىلى TG – تېلېگرامما (org.telegram.messenger.wcb) – 100+ downloads

The previous application on the record interprets to “Telegram – TG Uyghur,” indicating a clear endeavor to goal the Uyghur local community.

It can be value noting that the deal name linked with the Participate in Store model of Telegram is “org.telegram.messenger,” whilst the deal name for the APK file specifically downloaded from Telegram’s web page is “org.telegram.messenger.web.”

The use of “wab,” “wcb,” and “wob” for the destructive bundle names, therefore, highlights the risk actor’s reliance on typosquatting methods in buy to move off as the authentic Telegram application and slip less than the radar.

Future WEBINARWay Also Susceptible: Uncovering the Point out of the Identity Attack Floor

Reached MFA? PAM? Service account defense? Obtain out how perfectly-equipped your business definitely is versus identity threats

Supercharge Your Capabilities

“At initially glance, these applications look to be whole-fledged Telegram clones with a localized interface,” the corporation claimed. “Everything appears and works practically the exact same as the actual issue. [But] there is a small change that escaped the consideration of the Google Engage in moderators: the contaminated versions house an extra module:”

The disclosure arrives days following ESET disclosed a BadBazaar malware campaign targeting the formal application market that leveraged a rogue model of Telegram to amass chat backups.

Related copycat Telegram and WhatsApp applications ended up uncovered by the Slovak cybersecurity company earlier in March 2023 that came fitted with clipper features to intercept and modify wallet addresses in chat messages and redirect cryptocurrency transfers to attacker-owned wallets.

Identified this article exciting? Stick to us on Twitter  and LinkedIn to read through far more exceptional material we publish.

Some parts of this article are sourced from:
thehackernews.com