It then sends the files to the murky organization behind the technology. Their identity remains a mystery.
They could then use that information to blackmail you – or worse.
Experts from the international cyber group Lab52 identified the malicious app and described it in a blog post last week.
They said that the malware has all the hallmarks of spy tech used by state-sponsored Russian hackers to target Americans and Europeans.
It’s unclear how the app, which is called “Process Manager”, is installed onto victims’ devices.
Previous Russian spyware campaigns have loaded malware onto devices via links sent over text or email.
Process Manager appears as a gear-shaped icon similar to the settings icon used in default versions of Android.
Once downloaded, a warning about app permissions is displayed to the user asking for access to the cameras and more.
If the user accepts these, the app is hidden and continues to run in the background indefinitely.
It keeps track of the user’s location using their device’s GPS signal and even records audio through the microphone.
Attackers can also use the spyware to access the device camera, read the target’s texts, access their call log and more.
The researchers said that the infrastructure used by the software appears similar to Turla, spyware developed by Russian hackers.
Turla snoopers have ties to the Kremlin and are behind a spate of eavesdropping campaigns against European politicians.
However, it is not clear if Russian hacking groups are behind the new spyware.
“Attribution to Turla does not seem possible given its threat capabilities,” researchers wrote.
To protect yourself against Android spyware, it’s worth regularly reviewing the app permission you have granted.
You can do that by heading to your device Settings and looking for Apps or Apps and Notifications and then Permissions.
Revoke the permissions of apps you don’t want to have access to your camera, microphone, and sensitive information.
Source: nypost.com
