GhostChat Spyware Attacking Android Users Via WhatsApp to Exfiltrate Sensitive Details

GhostChat is an Android spyware campaign that lures users in Pakistan with fake dating profiles requiring hardcoded unlock codes; victims side-load a malicious app that masquerades as a chat platform while silently harvesting device identifiers, contacts and files, continuously monitoring new images and documents, and exfiltrating data over HTTPS to attacker-controlled servers. The threat uses persistence (BOOT_COMPLETED, foreground service), content observers for ongoing surveillance, and directs victims to WhatsApp numbers run by the operators to facilitate the romance scam.