Bingechat

BingeChat is a malware that has been active since August 2022, distributed under the guise of the messaging apps BingeChat and Chatico. The malicious software was first identified in June 2022 as an updated version of an Android remote access trojan known as GravityRAT, which was found to be masquerading as these messaging apps as part of a targeted cyber threat campaign. Distributed through a website advertising free messaging services, BingeChat requests various permissions upon installation, posing as a standard instant messaging app, thereby infiltrating mobile devices. The malware utilizes a Trojanized chat app called BingeChat to specifically target WhatsApp backup files on the infected devices. This new version of GravityRAT, now enhanced with additional capabilities, was reported by researchers to infect mobile devices using the trojanized BingeChat app. ESET researchers have also revealed how this updated GravityRAT spyware is being spread as the free messaging apps BingeChat and Chatico, used to exfiltrate victims' WhatsApp backups among other malicious actions. While both BingeChat and Chatico were initially used for the malware distribution, currently only the campaign using BingeChat remains active, with Chatico no longer in use. Despite having the same malicious functionality as Chatico, future discussions will focus solely on the ongoing BingeChat campaign. As of now, the BingeChat campaign continues to pose a significant threat to unsuspecting users, demonstrating the persistent and evolving nature of such cyber threats.