Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Fake End-to-end Encrypted Chat App Distributes Android Spyware

Fake End-to-end Encrypted Chat App Distributes Android Spyware

The GravityRAT remote access trojan is being distributed in the wild again, this time under the guise of an end-to-end encrypted chat application called SoSafe Chat.

This particular RAT (remote access trojan) targets predominately Indian users, being distributed by Pakistani actors.

The telemetry data on the most recent campaign shows that the targeting scope hasn’t changed, and Gravity is still targeting high-profile individuals in India, like officers of the Armed Forces.

Also Read: Digital Transformation – Do Or Die in 2020

Disguised as a secure chat app

In 2020, the malware was targeting people via an Android app named ‘Travel Mate Pro,’ but since the pandemic has slowed down traveling, the actors moved to a new guise.

The app is now called ‘SoSafe Chat’ and is promoted as a secure messaging application that features end-to-end encryption.

The SoSafe Chat website
The SoSafe Chat website

The website that likely played a role in the distribution of the app ([.]in) remains online today, but the download link and the registration form are no longer working.

The channel and method of distribution remain unknown, but it was likely by driving traffic to the site through malvertising, social media posts, and instant messages to targets.

Extensive spying abilities

Once installed on a target’s device, the spyware can perform a wide range of malicious behavior, allowing the threat actors to exfiltrate data, spy on the victim, and track their location.

The complete list of malicious behavior includes

  • Read SMS, Call Logs, and Contacts data
  • Change or modify system settings
  • Read current cellular network information, the phone number and the serial number of the victim’s phone, the status of any ongoing calls, and a list of any Phone Accounts registered on the device
  • Read or write the files on the device’s external storage
  • Record audio
  • Gets connected network information
  • Get the device’s location

According to researchers at Cyble, the list of permissions that the malware requests for this functionality is naturally quite extensive, but it can still appear justified for an IM app.

Permissions requested by SoSafe upon installation
Permissions requested by SoSafe
Source: Cyble

Compared to the 2020 version, GravityRAT has added the ability to record audio and added mobile-specific features like location fetching and cellular network data exfiltration.

Also Read: The Importance of Penetration Testing for Businesses

SMS exflitration function
SMS exflitration function
Source: Cyble

Before the 2020 version, GravityRAT would exclusively target Windows machines, not having the ability to infect mobile devices.

As such, the reemergence of the malware in the wild in targeting mobile devices indicates that its authors are actively developing it.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us