The cyber espionage group known as Bahamut has been attributed as behind a highly targeted campaign that infects users of Android devices with malicious apps designed to extract sensitive information.
The activity, which has been active since January 2022, entails distributing rogue VPN apps through a fake SecureVPN website set up for this purpose, Slovak cybersecurity firm ESET said in a new report shared with The Hacker News.
At least eight different variants of the spyware apps have been discovered to date, with them being trojanized versions of legitimate VPN apps like SoftVPN and OpenVPN. None of these apps are available on Google Play Store.
The tampered apps and their updates are pushed to users through the fraudulent website. It’s also suspected that the targets are carefully selected, since launching the app requires the victim to enter an activation key to enable the features.
This implies the use of an undetermined distribution vector, although past evidence shows that it could take the form of spear-phishing emails, SMS messages, or direct messages on social media apps.
images from Hacker News