The hackers, dubbed by researchers at cybersecurity company ESET as GREF, also released a version on Samsung’s Galaxy Store. The main aim of the fake Signal, which was called Signal Plus Messenger and functioned the same as the legitimate version, is to spy on communications of the real app, according to ESET researcher Lukas Stefanko.
The standard version of Signal allows users to link the mobile app to their desktop or Apple iPad. The malicious Signal Plus Messenger abused that feature by automatically connecting the compromised device to the attacker’s Signal in the background, so all messages were passed onto their account"
