The notorious hacker group known as Transparent Tribe is back at it, rolling out malware-laden Android apps in a crafty social engineering campaign aimed at high-profile targets.
In their latest move, these attackers are embedding their spyware into apps that seem harmless, like video streaming or gaming apps. But don’t be fooled—these apps are designed to lure in mobile gamers, weapons enthusiasts, and TikTok fans, only to deliver a nasty piece of spyware called CapraRAT.
According to Alex Delamotte, a security researcher at SentinelOne, this ongoing campaign—dubbed “CapraTube”—first came to light in September 2023. The attackers are disguising their spyware as legitimate apps, including YouTube, to trick users into downloading them. Once installed, the CapraRAT spyware, which is a souped-up version of the notorious AndroRAT, can access a wide array of sensitive data on your device.
Transparent Tribe, believed to have ties to Pakistan, has been using CapraRAT for over two years, primarily targeting Indian government and military personnel. They’re well-versed in tactics like spear-phishing and watering hole attacks, and they’ve shown a knack for delivering both Windows and Android spyware.
What’s particularly alarming about this new campaign is how the attackers are constantly refining their approach. They’re not just sticking with old Android versions; they’re updating their tactics to ensure their spyware can infiltrate even the latest Android OS versions. This suggests they’re zeroing in on individuals with newer devices, likely those in sensitive government or military roles.
SentinelOne recently identified a new batch of malicious APK files tied to this campaign, including apps with names like “Crazy Game,” “Sexy Videos,” “TikToks,” and “Weapons.”
These apps use WebView to load a legitimate-looking URL, like YouTube or CrazyGames[.]com, but in the background, they’re quietly accessing your location, SMS messages, contacts, call logs, and even recording audio and video without your knowledge.
Interestingly, the latest version of CapraRAT seems to have dropped certain permissions requests, which might indicate a shift towards using it primarily as a surveillance tool rather than a backdoor for further attacks.
Delamotte notes that while the recent updates to CapraRAT’s code are minor, they’re focused on making the spyware more stable and reliable. The decision to target newer Android versions aligns with their ongoing focus on high-value targets, such as those within the Indian government or military, who are more likely to use up-to-date devices.
This disclosure comes alongside news from Promon about another sneaky Android threat called Snowblind. Much like CapraRAT, Snowblind is a banking malware that uses the Android OS’s accessibility services to bypass detection and security checks, steal credentials, and disable crucial features like two-factor authentication (2FA). The sophistication of these threats shows just how advanced malware developers, especially in Southeast Asia, have become.
In an age where mobile devices are integral to both personal and professional life, especially in sectors like education and government, the security of apps has never been more critical. With spyware like CapraRAT lurking behind seemingly innocent apps, it’s essential for Android users to stay vigilant, only download apps from trusted sources, and regularly review app permissions to ensure their data stays safe.