Cyble Research & Intelligence Labs (CRIL) has identified a new type of Android malware that has been targeting users in Thailand, the Philippines, and Peru since July 2022. The same malware was discovered in September 2017.

This new malware is a RAT (Remote Access Trojan) family that has been modified to appear as an application from various government agencies. The malware disguises itself as the following:

•Police Department of the Philippines (This application is designed to steal users' contacts and SMS)

•Royal Thai Army (This application is designed to steal users' contacts, call logs, SMS, and information about Wi-Fi connections)

•Peruvian Police

This malware attempts to spread by sending phishing messages containing a link that points victims to downloading the application from Google Play Store.

‍

Source: Gigabud RAT: New Android RAT Masquerading as Government Agencies - AlienVault - Open Threat Exchange