Cyber-mercenary group targets Android users with fake Trojan VPN apps

A malicious spyware campaign has been discovered by cybersecurity software firm ESET, where trojan VPN apps are used to steal data from messaging apps like WhatsApp, Messenger, Signal, Viber, and Telegram. The campaign is targeting Android users.

These spyware apps are distributed through a fake SecureVPN website that provides only trojan Android apps to download. Trojans apps are essentially deceptive programs that appear to perform a particular function but actually perform another. The campaign is being run by Bahamut APT – a group that specialises in cyberespionage, usually through fake applications. Targets for these attacks are typically entities and individuals in the Middle East and South Asia.