Signal Plus Messenger

Signal Plus Messenger and FlyGram are malware variants of a sophisticated espionage tool named BadBazaar, believed to be orchestrated by a China-linked threat actor known as Gref. These malicious applications were distributed through the Google Play store, Samsung Galaxy Store, and specific websites, imitating popular communication apps Signal and Telegram. The campaign has been ongoing since July 2023, targeting Android users. Both Signal Plus Messenger and FlyGram contain code to check if the device operator is Chinese, similar to BadBazaar. While several vendors have tied BadBazaar to APT15, ESET could not conclusively establish this link. The primary objective of these malware variants is user data exfiltration and espionage. BadBazaar steals device information such as contact lists, call logs, and installed applications, and spies on Signal conversations by secretly attaching the victim’s Signal Plus Messenger app to the attacker’s mobile device. FlyGram can extract sensitive data like contact lists, phone logs, and Google Accounts, along with basic device information. Signal Plus Messenger collects similar data but focuses primarily on tracking the victim's Signal communications. Signal Plus Messenger, once available on Google Play and Samsung Galaxy Store, misuses the link device feature to spy on Signal messages. This allows active espionage on exchanged Signal communication. Despite their harmful nature, these malicious apps were uploaded and disseminated under the guise of legitimate applications. It's important to note that these apps pose a significant risk to users, as they can steal personal information, disrupt operations, or even hold data hostage for ransom.