Love? Actually Fake dating app used as lure in targeted spyw...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/
• Blog Title: Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan
• Suggested Section: HackTricks Main -> Phishing Methodology (add/extend a page on ClickFix / user-assisted execution) and cross-link from Windows -> Basic PowerShell for Pentesters (base64 tasking, hidden execution) / Windows tradecraft (rundll32 DLL export execution)

🎯 Content Summary

Title / context
ESET reports a targeted, multi-platform espionage operation aimed at users in Pakistan (blog dated 28 Jan 2026). The core payload is an Android spyware app dubbed GhostChat (Android/Spy.GhostChat.A) that masquerades as a dating/chat app. The operation expands to Windows via a ClickFix user-assisted execution chain delivering a malicious DLL (Win64/Agent.HEM) and also includes a WhatsApp account takeover via abuse of WhatsApp’s “Lin...

🔧 Technical Details

Hardcoded “authentication” + hardcoded “unlock” gates as a romance-scam credibility layer
A trojan Android app can simulate exclusivity by embedding static credentials and per-feature “unlock codes” directly in the APK (no server validation). The UI pushes victims through a gated flow (login → locked profiles → unlock code) while the malware runs background collection/exfiltration. When each locked item is mapped to an embedded communication endpoint (e.g., fixed WhatsApp numbers), correct codes can trigger an intent redirect into a real messaging app to continue social engineering, keeping victims engaged while ongoing theft continues.

ClickFix (user-assisted execution) to deliver a DLL loader chain
ClickFix lures use fake alerts and step-by-step “fix instructions” to convince users to manually execute malicious actions (download/run). In this case the outcome is execution of a malicious DLL, which then beacons host identity to a C&C URL and e...

🤖 Agent Actions

Updated phishing-methodology/README.md with new ClickFix tradecraft details (rundll32 DLL chain, hidden/base64 PowerShell tasking and hunting cues), expanded mobile phishing coverage to include the romance-gated GhostChat APK flow and QR-based WhatsApp device-link hijack, and added relevant references to the ESET research and IoC repository. No tests were run (docs-only change).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/

Content Categories: Based on the analysis, this content was categorized under "HackTricks Main -> Phishing Methodology (add/extend a page on ClickFix / user-assisted execution) and cross-link from Windows -> Basic PowerShell for Pentesters (base64 tasking, hidden execution) / Windows tradecraft (rundll32 DLL export execution)".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0