Chatico

Chatico is a malicious software (malware) that was discovered to be part of a targeted cyber threat campaign since June 2022. The malware, based on the OMEMO Instant Messenger app, was trojanized with GravityRAT, a notorious Android remote access trojan. The group behind this threat employed a fraudulent app called “Chatico,” distributed through the website “chatico.co[.]uk.” This malware impersonated popular chat applications like BingeChat and Chatico, masquerading as legitimate services to deceive users into downloading and installing them. The malware's key functionality involved exfiltrating victims' WhatsApp backups among other malicious actions. Once installed, it could exploit and damage the user's device, stealing personal information and disrupting operations. The malware was also found to communicate with a command and control (C&C) server hosted by Amazon.com, Inc. at IP address 75.2.37[.]224 under the domain name "jre.jdklibraries[.]com" for further instructions or data exfiltration. In November 2022, cybersecurity firm ESET revealed that SpaceCobra, the group behind the malware, had branded GravityRAT as Chatico. An updated version of GravityRAT continued to be distributed as free messaging apps, including BingeChat and Chatico. Despite the focus shifting towards the active campaign using the BingeChat app, it was noted that it retained the same malicious functionality as Chatico.