GravityRAT is a spyware tool targeting and spreading via traveling apps, some of which are legitimate apps on the Google Play store. The modified version appears to have been modified for the sole purpose of installing the spyware; the code for Travel Mate is available on Github. Once modified, attackers change the name to Travel Mate Pro. Upon installation, the app attempts to gain access to photos, media, and files stored on the victim’s device. Exfiltration of device data, contact lists, email addresses, call, and text logs is the purpose of this instance. The code used is not based on any similar code or other spyware apps. The C2 address is hardcoded and is used to download files of varying types to the device. The spyware issues commands to obtain system info, search for doc types files, list running processes, log keystrokes, and more. New versions of GravityRAT are written in .NET and Python; the .NET versions target Sharify and MelodyMate, and the Python version targets GoZap. Multiplatform versions include StrongBox, TeraSpace, OrangeVault, and CvStyler. Android versions include SavitaBhabi (also a Windows version). An assumption can be made that the current version of GravityRAT uses similar infection methods to previous versions – targeting users by sending them links to the malicious apps. The main modification is that the RAT can now infect multiple platforms.