2023-06-17 23:21:19
ESET researchers warn of resurgence of GravityRAT. The malware, well known in the industry, is making a comeback and this time attacks WhatsApp backups.
If the name GravityRAT means nothing to you, we hope it always will. Active since 2015 and specialist in data theft, the malware has been back for a few months. Operated by the SpaceCobra pirate group, the software now attacks WhatsApp backups.
In a recently published press release, researchers from ESET, a company specializing in cybersecurity, warn Android users. According to the company, hackers hide their malware behind two “legitimate” applications. Namely: BingeChat and Chatico. Both advertise themselves as “end-to-end encrypted” messaging services, but the reality is of course quite different.
Safeguards at risk
First of all, it should be remembered that WhatsApp backups do not benefit from end-to-end encryption. When the malware accesses it, all the information appears to it in clear text. This includes access to contacts, location, SMS, storage, call logs, camera and microphone, among others. So many standard authorizations for most messaging, but which is more problematic in this case.
As soon as the permissions are granted, GravityRAT reports to the control server and provides it with a whole series of information. Including those on the device itself. Besides, the software can also erase all the files, if the request reaches it.
Note that the two malicious apps, BingeChat and Chatico, are not available on the Play Store, but on third-party app stores. As always, be careful not to download software whose source you do not know. Remember that if the services offered seem too good to be true, they often are.
_
Follow Geeko on Facebook, Youtube and Instagram so you don’t miss any news, tests and tips.
1687049275
#Beware #virus #steal #WhatsApp #data
