Flygram

FlyGram is a malicious software (malware) that first appeared on Google Play in July 2020 and was removed in January 2021. It was designed to exploit and damage users' devices by stealing sensitive data, including basic device information, contact lists, call logs, and Google Account data. The malware was hidden in a trojanized version of the legitimate app Telegram, named FlyGram. A promotional YouTube video for the backdoored FlyGram app was also discovered. At least 13,953 individuals who downloaded FlyGram activated it, according to telemetry related to a specific backup feature. The distribution of this malware was part of a sophisticated espionage campaign believed to be orchestrated by a China-linked threat actor known as Gref. This campaign has been ongoing since July 2023 and involves another malware called BadBazaar, which targets Android users via fake versions of popular communication apps Signal and Telegram. These malicious apps, named Signal Plus Messenger and FlyGram, were used as vehicles for this operation. Signal Plus Messenger was published in app stores in July 2022 and was not removed from Google Play until May 2023. Interestingly, due to a misconfiguration of the C2 server, it was possible to enumerate the API endpoints used by the FlyGram variant. This revealed that the threat actor had configured API endpoints for an iOS version of the app. ESET researchers have revealed the malware’s capabilities in a technical write-up, including FlyGram's extensive data harvesting features and limited access to specific Telegram-related data. These findings highlight the evolving nature and growing sophistication of malware threats targeting mobile devices.