Bahamut Android Spyware Used Phishing Sites to Steal Mobile Data and Chat Content

The Bahamut threat group ran Android espionage campaigns that used phishing websites to trick victims into installing malicious APKs disguised as religious community apps, secure messaging tools, and other themed applications. Researchers linked the activity to domains including jamaat-ul-islam[.]com, jamatapplication[.]com, jamaatforummah[.]com, jamaatforallah[.]com, and securechatnow.com, with targeting focused on users in the Middle East and South Asia. The lures impersonated trusted services and communities to deliver spyware under names such as "Chat Services" and counterfeit Jamaat chat apps.

Once installed, the malware sought extensive Android permissions and abused Accessibility Service to conduct broad surveillance on infected devices. It collected contacts, SMS messages, call logs, files, location data, audio, device identifiers, and notification content, and newer variants expanded collection to messaging platforms including WhatsApp, Signal, Telegram, Viber, Imo, Facebook Messenger, ProtectedText, and Tor-related chat apps. Stolen data was stored locally and exfiltrated to command-and-control infrastructure over HTTPS using Socket.IO, with uploads triggered by device events and on a recurring four-hour schedule.