Remote access Trojan found in applications distributed on Play Store

Strong malware was found in 12 apps, six of which were distributed through the Play Store by September 2023. Malware known as VajraSpy paves the way for unauthorized remote access.

Malicious apps were listed on the Play Store between April 1, 2021 and September 10, 2023. Even though they have been removed from the Google platform, they still need to be distributed via the web or alternative app stores.

After being infected by VajraSpy, user’s personal data (contacts, messages and other information) may be stolen. The more permissions the infected application has, the more content it can control, You can even record calls.

According to researchers from the ESET group that discovered the malware, its focus is on targeting users residing in Pakistan. RAT operators are part of Patchwork APT, which has been active since 2015.

What does VajraSpy do?

VajraSpy is a spyware and Remote Access Trojan (RAT). It has monitoring and data theft features.

According to the documents, spyware can steal and share the criminal’s data, intercept and extract messages from encrypted applications such as WhatsApp and Telegram, record calls, access the device’s camera to take photos and videos, intercept notifications, and more.

Which applications were infected with viruses?

Check which applications are infected with VajraSpy according to ESET:

• Rafakat;
• PriveeTalk;
• Meet with me;
• Let’s chat;
• Quick chat;
• Stag chats;
• Hello Chat
• YohooTalk
• TikTalk
• nidus
• GlowChat
• Wave Chat

Many malicious applications act as messengers. In general, these apps need various permissions to work, such as access to contact lists and media, making them a big problem for authorization-dependent malware.