Google Play Used to Spread 'Patchwork' APT's Espionage Apps

ESET researchers uncovered an espionage campaign by the Patchwork APT that distributed a new Android RAT called VajraSpy via six malicious Google Play apps (and six more on third-party stores). The trojanized apps—named Privee Talk, MeetMe, Let's Chat, Quick Chat, Rafagat, and Faraqat—were downloaded over 1,400 times, could intercept calls, SMS, files and contacts, extract WhatsApp and Signal messages, record calls and take pictures, and appear to have targeted Pakistani users using honey-trap romance lures; Google removed the apps after ESET reported them.