Bahamut Malware Returns With New Spying Features

Bahamut, an APT group, resurfaced in April 2022 with a new Android spyware variant distributed via professionally designed phishing sites masquerading as secure messaging apps; the malicious APK (com.chat.services) abuses Accessibility and multiple sensitive permissions to capture data from messaging apps (Viber, Telegram, WhatsApp, Signal, etc.), contacts, SMS, call logs, audio and files, and exfiltrates stolen data to identified C2 servers. The report provides technical analysis, APK metadata and hashes, targeted package names, MITRE ATT&CK mappings, IOCs (URLs and hashes), and recommended mitigations.