Security researchers at Positive Technologies analyzed a malicious Android application disguised as a security tool named 'Antivirus FSB'. The app is a modified version of the legitimate Right Dialer, into which the LunaSpy spyware has been injected.
The malware utilizes the Accessibility Service to gain extensive control over the device. New features include recording phone calls, redirecting outgoing calls based on JSON rules, and managing device logs. It also supports remote commands to simulate user actions like taps, swipes, and text input.
The spyware includes anti-detection and control mechanisms, such as encrypting strings with XOR, mimicking device reboots, and disabling Google Play Protect. It can also prompt users for camera and microphone permissions via overlays.
Experts advise users to avoid downloading applications from untrusted sources, to verify permissions carefully, and to monitor device activity to detect potential infections.
