Newly Discovered “System Update” Android Malware Steals Photos, Videos & GPS Location

As soon as the user downloads this destructive app on their smart device, the app contacts the Firebase server and begins managing the gadget from another location. The security professionals have affirmed that this malicious app screen itself as “System Update.”.

And here once the user grants the access, it will just take over the control of the device and will get access to all the following things that we have discussed listed below:-.

New Malware: “System Update”.

In this scenario, when the user clicks on the notification, the malware asks the user to install this new application, which will later on ask for full access to the gadget..

This brand-new “System Update” malware is remarkably advanced malware, and this malware tricks and contaminates the users by launching a notice that pretends to be a system upgrade.

We should constantly remain alert and careful with the applications that we set up and download from outside the Play Store because we can download an app with malware that might contaminate our Android gadgets.

As just recently, the cybersecurity researchers at Zimperium have actually found a destructive app that can be downloaded outside of Google Play (third-party Android app shops)..

Messages in messenger apps.
It will likewise have access to the messenger database files if you have root rights.
Searching history.
Search history in Chrome, Mozilla Firefox and Samsung web browser.
Numerous types of files like.pdf,.
Clipboard data.
Material of the notifications.
List of set up apps.
Images and Videos.
GPS place information.
SMS messages.
Call logs.
Recording audio.
Recording phone calls.
Installed apps..
Device name.
Storage statistics.

How Does It Work?

However, here, the most peaceful thing is that this malicious app has never been readily available on Google Play, and not just that, even the designers at Google are attempting their best to prevent it from preventing its security walls.

Nevertheless, here the Firebase is used only for conveying commands, while a separate C&C server is used to collect other stolen information using POST requests. This malware gathers data straight if it has root gain access to or uses the “Accessibility Services” function on the compromised gadget.

To conceal its destructive activities, it publicised fake notices about the search for updates when it receives brand-new commands from its speculators.

You can follow us on Linkedin, Twitter, Facebook for day-to-day Cybersecurity, and hacking news updates.

According to the report, the malware sends out numerous information to its Firebase C&C server just after getting set up on the device. And the data that it sends consists of storage stats, ISP information, and set up apps..