Suspected Chinese-linked threat actors are targeting Android users with trojanized Signal and Telegram apps containing “BadBazaar” spyware. The malicious apps, called Signal Plus Messenger and FlyGram, were distrusted through the Google Play store and Samsung Galaxy store but have since been taken out of the Google Play store. The suspected GREF threat actor group has previously used BadBazaar malware to target ethnic minorities in China, but their current campaign targets users in Ukraine, Poland, the Netherlands, Spain, Portugal, Australia, Germany, Hong Kong, the United States, and more. Once installed, BadBazaar collects and exfiltrates a wide range of sensitive user data, including call logs, SMS messages, contact lists, precise locations, and others. If a user enables a specific Cloud Sync feature from the FlyGram trojanized app, it grants the hackers full access to users’ Telegram chat backups, which has been activated by at least 13,953 user accounts so far. Additionally, the malicious Signal Plus Messenger app has the ability to bypass the usual Signal QR-code linking process used to connect multiple devices to an account, allowing the threat actor to spy on victims’ Signal communications from attacker-controlled devices. Signal users can view and manage all connected devices via the “Linked Devices” setting on the real Signal app in order to check for rogue connections.