Android Malware Impersonates ChatGPT-Themed Applications
Summary: Unit 42 researchers documented two active Android malware clusters impersonating ChatGPT: a Meterpreter Trojan disguised as a "SuperGPT" app that establishes remote access to the device, and a "ChatGPT" app that sends SMS messages to premium-rate numbers in Thailand, with the charges pocketed by the threat actor. The SuperGPT sample, first submitted to VirusTotal from Nicaragua on 2023-03-16, was signed with a certificate tied to an actor in Shahdara, Delhi, India, that is attached to over a hundred other publicly shared malware samples.
Why it matters: The SuperGPT sample's Meterpreter payload connects to a hard-coded remote endpoint and can download a secondary payload with commands such as dump_sms, so a single sideloaded app can hand an attacker the device's text messages and more.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026