In the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive commands to delete files. Most likely active since August 2022, the BingeChat campaign is still ongoing. The actor behind GravityRAT remains unknown ESET Research tracks the group known as SpaceCobra. Windows, Android, and macOS versions are available. GravityRAT is a remote access tool previously used in targeted attacks against users in India. Just as in previously documented SpaceCobra campaigns, the Chatico campaign targeted a user in India.īRATISLAVA, KOŠICE - JESET researchers have identified an updated version of the Android-based GravityRAT spyware being distributed as the messaging apps BingeChat and Chatico. The campaign is very likely highly targeted.This version of GravityRAT is enhanced with two new capabilities: receiving commands to delete files and exfiltrating WhatsApp backup files.The trojanized BingeChat app is available for download from a website that presents it as a free messaging and file sharing service.ESET Research discovered a new version of Android GravityRAT spyware being distributed as trojanized versions of the legitimate open-source OMEMO Instant Messenger Android app.
0 kommentar(er)
