GhostChat Android Spyware Campaign Uses Romance Scams to Target Users

ESET has identified a sophisticated Android spyware campaign known as GhostChat, which specifically targets users in Pakistan through romance scams. The operation involves a malicious application disguised as a chat service, which routes conversations through WhatsApp. This campaign is notable for its unique deception method, where fake female profiles are presented to victims as locked, requiring passcodes that are hardcoded into the app, creating an illusion of exclusivity.

The GhostChat app is not available on Google Play and is instead downloaded from unofficial sources. Google Play Protect blocks the app by default, indicating its malicious nature. Once installed, the spyware runs in the background, monitoring device activity and sending sensitive data to a command-and-control server.

In addition to GhostChat, the same threat actor is linked to broader surveillance efforts, including ClickFix attacks that compromise victims’ computers and WhatsApp device-linking attacks. These operations utilize fake websites impersonating Pakistani government organizations to lure victims into downloading malicious software.

Victims are often prompted to join community channels that falsely claim to be associated with the Pakistan Ministry of Defence. They are then encouraged to scan QR codes to link their devices to WhatsApp Web or Desktop, a tactic known as GhostPairing, which allows attackers to access chat histories and contacts.

Why This Matters for Your Security

This campaign highlights the risks associated with downloading apps from unofficial sources and the potential for social engineering tactics to deceive users. The use of local Pakistani numbers for the fake profiles adds an element of credibility, making it crucial for users to be vigilant about the authenticity of online interactions.

Organizations and individuals should be aware of the signs of romance scams and the potential for spyware to infiltrate their devices. Continuous monitoring of device activity and data access is essential to mitigate risks associated with such threats.

• GhostChat: A malicious app disguised as a chat service that steals data from infected devices.
• ClickFix: A social engineering technique that convinces victims to run malicious code by following seemingly legitimate instructions.
• GhostPairing: A method that allows attackers to access WhatsApp accounts through QR code scanning.
• WhatsApp: A widely used messaging platform that is targeted in this spyware campaign.
• ESET: The cybersecurity firm that discovered the GhostChat spyware campaign.