Thread by @ESETresearch

#ESETresearch discovered an active #Android campaign conducted by the hack-for-hire group #Bahamut. The campaign has been active since January 2022, with malicious apps are distributed through a fake #SecureVPN website
@LukasStefanko welivesecurity.com/2022/11/23/bah… 1/6

We discovered at least 8 versions of the spyware, all trojanized versions of legitimate VPN apps SoftVPN and OpenVPN; none have been available on Google Play. The fake SoftVPN triggered our YARA rules; we also got a DM from @malwrhunterteam about the sample. TY folks!
2/6

The fake website was registered on 2022-01-27 and created based on a free web template. It was most likely used by the threat actor as an inspiration, as it required only small changes and looks trustworthy.
3/6

Bahamut malware exfiltrates contacts, SMS messages, device location, recorded phone calls, and more from affected devices. It also spies on chats exchanged through messaging apps including @signalapp, @Viber, @WhatsApp, @telegram, and Facebook @messenger via keylogging. 4/6

Targets of this campaign are carefully picked – the spyware requires an activation key, and we think the victim is provided with the key together with the malicious app. 5/6

The group behind this threat, Bahamut, was named by @bellingcat after an enormous fish from Arabic mythology. Bahamut previously targeted entities in the Middle East and South Asia, and individuals connected to these regions, with spearphishing messages. 6/6