Bahamut Spyware Spread Through Trojanized Android VPN Apps
Threat Actor Intelligence · 2 sources · Updated 2mo ago · First seen Mar 20, 2022
The Bahamut cybermercenary group ran a targeted Android espionage campaign that distributed spyware through a fake SecureVPN website, using trojanized versions of legitimate VPN applications to infect victims. Researchers said the operation had been active since at least January 2022 and initially repackaged SoftVPN before later shifting to OpenVPN, embedding Bahamut spyware while gating execution with an activation-key mechanism that likely restricted infections to selected targets.
The malware was built for covert surveillance and data theft, with capabilities to collect contacts, SMS messages, call logs, location data, device details, installed-app lists, and files, as well as record phone calls. It also abused Android accessibility services to monitor messaging apps and enable keylogging. Investigators identified at least eight malware variants and linked the fake VPN infrastructure to earlier Bahamut activity through code overlap and operational similarities with prior SecureChat campaigns, reinforcing the assessment that the operation was low-volume, highly targeted, and designed for espionage rather than mass distribution.
