Instant messaging applications such as Telegram and Signal have modified versions known as ‘mods’. These alternative apps “should be handled with caution,” according to cybersecurity company Kaspersky, which identified spyware on both platforms from Google Play. Although spyware versions of these apps are no longer available, researchers say there may be users who continue to use these “quick and easy” messaging modifications that expose all their messages to prying eyes.
Kaspersky researchers discovered several apps infected with spyware on Google Play. These apps, found on September 8, appeared to be Uighur, Simplified Chinese, and Traditional Chinese versions of Telegram. The descriptions are written in these languages and contain images similar to those on the official Telegram page on Google Play. To persuade users to download these mods, the developer claims that they work faster than other clients thanks to a distributed network of data centers around the world.
There are also malicious versions of Signal on Google Play: On August 30, antivirus company ESET identified an infected version of Signal in Google Play and the Samsung Galaxy Store, called Signal Plus Messenger. Inside, this app was almost completely equivalent to the original platform; However, its open source was “flavored” with malicious additives, according to researchers.
