VajraSpy: A Patchwork of espionage apps

ESET Research uncovered a targeted espionage campaign attributed with high confidence to the Patchwork APT involving 12 Android apps bundled with the VajraSpy RAT; six were distributed through Google Play (over 1,400 installs) and six were found in the wild. The malware exfiltrates contacts, SMS, call logs, files, notifications and—when granted accessibility privileges—WhatsApp/Signal messages, and in some variants can record calls, capture audio/video, perform keylogging, and scan Wi‑Fi; operators used Firebase and other C2 servers and the report includes hashes, domains/IPs, victim geolocation (148 devices) and MITRE ATT&CK mappings.