Android Gravityrat

Android GravityRAT is a malicious software (malware) known for its ability to infiltrate and damage systems. ESET researchers have identified an updated version of this malware being distributed through the messaging apps BingeChat and Chatico, as well as trojanized versions of the legitimate open-source OMEMO Instant Messenger Android app. Unlike previous versions that could only upload exfiltrated data to a Command & Control (C&C) server at specific times, this updated variant has shown increased functionality, including the capability to steal WhatsApp backup files and receive commands to delete files. The updated version of Android GravityRAT was first detected in India in June 2022. Subsequent investigations by ESET revealed that a Pakistan-based group known as SpaceCobra was utilizing this updated malware to specifically target and steal WhatsApp backup files, thereby gaining access to potentially sensitive personal information. The malware also had the ability to delete files on victim devices, further increasing its potential for harm. Security researchers at ESET have been closely monitoring the developments of Android GravityRAT. Their findings have been widely reported, highlighting the increasing sophistication of the malware and its potential threat to users' security and privacy. As such, users are advised to remain vigilant when downloading apps and to regularly update their systems to protect against such threats.