We should always stay alert and cautious with the applications that we download and install from outside the Play Store since we can download an app with malware that could infect our Android devices.
As recently, the cybersecurity researchers at Zimperium have discovered a malicious app that can be downloaded outside of Google Play (third-party Android app stores).
Once the user downloads this malicious app on their smartphone, the app contacts the Firebase server and starts controlling the device remotely. Moreover, the security experts have affirmed that this malicious app screen itself as “System Update.”
New Malware: “System Update”
This new “System Update” malware is surprisingly sophisticated malware, and this malware tricks and infects the users by launching a notification that pretends to be a system update.
In this situation, when the user clicks on the notification, the malware asks the user to install this new application, which will later request full access to the device.
And here once the user grants the access, it will simply take over the control of the device and will get access to all the following things that we have mentioned below:-
- Messages in messenger apps.
- If you have root rights, then it will also have access to the messenger database files.
- Bookmarks.
- Browsing history.
- Search history in Chrome, Mozilla Firefox and Samsung browser.
- Several types of files like .pdf, .doc, .docx, and .xls, .xlsx.
- Clipboard data.
- Content of the notifications.
- List of installed apps.
- Images and Videos.
- GPS location data.
- SMS messages.
- Contacts.
- Call logs.
- Recording audio.
- Recording phone calls.
- Installed apps.
- Device name.
- Storage statistics.
- Camera.
How Does It Work?
According to the report, the malware sends various data to its Firebase C&C server just after getting installed on the device. And the data that it sends includes storage stats, ISP details, and installed apps.
However, here the Firebase is used only for conveying commands, while a separate C&C server is used to collect other stolen data using POST requests. This malware collects data directly if it has root access or uses the “Accessibility Services” function on the compromised device.
Moreover, to hide its malicious activities, it publicised fake notifications about the search for updates when it receives new commands from its speculators.
