PJobRAT Disguised as Android Dating App Steals Contacts, SMS & GPS data


Given that December 2019 the recent version of PJobRAT spyware has actually been around, as reported by the scientists at 360 Core Security Lab.

In the current age, hackers are continuously progressing and using their strategies to carry out new attack vectors to target users from various sectors around the world, as reported by the security researchers at Cyble.

Data gathered by PJobRAT via fake apps.

The cybersecurity experts of Cyble along with 360 Core Security Lab have actually recently discovered the PJobRAT spyware in dating and instantaneous messaging apps Not only that even, the experts have actually likewise declared that the spyware samples camouflaged themselves as Android dating apps.

While throughout their investigation they discovered that for Non-resident Indians this recent version is disguising as a popular dating app known as “Trendbanter,” and imitating the immediate messaging app, Signal.

The spyware project that currently revealed primarily targeting the Indian military workers, and because January 2021 this campaign has actually been active.

Other apps utilized

While the specialists have asserted that to hide in the app list, it imitates WhatsApp or any genuine-looking app. The most bizarre thing is that it doesnt even match the icon shown in the app store with the installed one.

In some cases, the scientists have determined that it also mimic other apps as well, and here they are mentioned listed below:-.

Kinds of Documents it Exfiltrates.


Furthermore, through different medium and third-party app stores, the danger stars accomplish their distribution goals in which they distribute all these spyware.

The types of documents that it able to exfiltrate from the contaminated gadget are discussed listed below:-


Publish address book.
Submit SMS.
Upload audio files.
Upload video file.
Publish image file.
Submit a list of set up apps.
Submit a list of external storage files.
Publish WiFi and GPS info.
Upload geographical place.
Update contact number.
Recording by means of the mic or camera.
Submit WhatsApp messages and contacts.

You can follow us on Linkedin, Twitter, Facebook for day-to-day Cybersecurity and hacking news updates.

The analysts have actually affirmed that the threat stars behind this spyware are not so sophisticated, because their private servers are openly available in which they hold the exfiltrated information.

The security scientists at 360 Core Security Lab has actually concluded that the hazard actors behind PJobRAT spyware could be Pakistani or chinese hackers, and thats why their primary goal was to spy on Indian military workers.

In regards to its code, the spyware stays the same, and not only that even it likewise interacts with the exact same infrastructure also..

The total list of capabilities of PJobRAT spyware is mentioned listed below:-.

The types of files that it able to exfiltrate from the infected gadget are mentioned listed below:-