# MA-968.092023: MyCERT Alert - Bogus versions of the Signal and Telegram Messenger Apps

**Date:** 09 Sep 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-968.092023  
**Advisory ID:** MA-968.092023

---

**1.0 Introduction**
This security advisory is issued to all Android smartphone users who may have inadvertently installed counterfeit messaging applications, Signal Plus Messenger and FlyGram, mistakenly believing them to be legitimate Signal and Telegram apps. While these malicious apps have been removed from official app stores and third-party platforms, they still pose a significant threat to your personal data and privacy if they are currently installed on your Android device.
Signal Plus Messenger and FlyGram were deceptive versions of the popular Signal and Telegram messaging apps, created by a malicious developer. They were distributed on various platforms, including the Play Store, the Galaxy Store, and third-party app storefronts, putting users at risk of unauthorized data access and potential privacy breaches.
Originally targeting users in China, these malicious apps have expanded their reach to target users in the following regions: Ukraine, Poland, the Netherlands, Spain, Portugal, Germany, Hong Kong, and the United States.
**2.0 Impact**
These counterfeit apps have been identified as posing the following risks:
- Stealing basic device information, including contact lists, Google accounts, and call logs.
- Backing up stolen data to a remote server controlled by the attacker.
- Monitoring and recording sent and received messages, potentially sending them to a remote server.
- Gaining access to your device's camera and recording phone calls.
**3.0 Affected System and Devices**
Android mobile devices
**4.0 Recommendations**
To protect your personal data and privacy, it is imperative that you take the following actions immediately:
- **Uninstall Both Apps**: If you have either Signal Plus Messenger or FlyGram installed on your Android device, remove them without delay.
- **Unlink Signal and Telegram Accounts**: Before uninstalling these malicious apps, unlink your Signal and Telegram accounts to prevent any unauthorized access.
- **Check Your Connected Devices**: Regularly review your connected devices list to ensure no unknown devices have accessed your accounts.
- **Consider Device Security**: If you have installed these fake apps, consider purchasing a new handset or performing a factory reset to eliminate any lingering security threats.
- **Exercise Caution**: Only download apps from legitimate app stores and trusted sources. Refrain from installing applications from unverified third-party sources, regardless of how enticing their features may appear.
If you own a Samsung Galaxy phone, please verify that you have not installed either fake app on your device, as they were listed on the Galaxy Store at one point. Ensure your device's security by following the steps mentioned above.
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.phonearena.com/news/delete-these-two-android-apps_id150359>
- <https://www.welivesecurity.com/en/eset-research/badbazaar-espionage-tool-targets-android-users-trojanized-signal-telegram-apps/>