China-Linked BadBazaar Android Spyware Targeting Signal and Telegram Users

Cybersecurity researchers have discovered malicious Android apps for Signal and Telegram distributed via the Google Play Store and Samsung Galaxy Store that are engineered to deliver the BadBazaar spyware on infected devices.
Slovakian company ESET attributed the campaign to a China-linked actor called GREF.
"Most likely active since July 2020 and since July 2022, respectively, the campaigns

actor android android apps android spyware apps called campaign china cybersecurity devices distributed eset galaxy galaxy store google google play google play store july malicious play play store researchers samsung samsung galaxy samsung galaxy store signal spyware store targeting telegram