Your Privacy at Risk: App You Can’t Remove Secretly Record Calls and Screenshots

Cybercriminals continuously seek new methods to infiltrate your mobile device. The latest example is the SpyNote malware. You can not delete the app containing this malware as it is designed to secretly record calls and screenshots.

According to the cybersecurity firm F-Secure, SpyNote deceives victims into downloading the application. SpyNote is a form of spyware distributed through smishing or deceptive mobile messages.

Although SpyNote doesn’t initially demand an extensive list of permissions. However, the ones it does request are reminiscent of those typically sought by spyware. Upon launch, it seeks the BIND_ACCESSIBILITY_SERVICE permission, and upon approval, it self-authorizes additional critical permissions.

Your Privacy at Risk: App You Can’t Remove Secretly Record Calls and Screenshots

The application attempts to conceal itself, remaining hidden from the app launcher and not appearing in the Recents screen. It relies on external triggers, such as an SMS, to activate.

SpyNote operates with two persistent “diehard” services, which are resistant to termination attempts by both the Android system and the victim. When you try to eliminate such apps, these malicious services automatically restart.

The primary objective of SpyNote is to extract as much data from the victim’s device as possible and transmit it to the attacker’s computer.

SpyNote possesses the capability to gather an extensive array of information on users, including the ability to record incoming phone calls and transmit them to its creators. Additionally, it can capture screenshots and dispatch them to a Command and Control centre.

Furthermore, SpyNote can record keystrokes on your device, effectively stealing your credentials and screen unlock passwords.

Eliminating SpyNote is notably challenging, as it conceals itself and evades straightforward deletion. It resists removal through the Settings app, as it closes the menu screen when accessed via Settings. Given its diehard services, the victim is unable to halt them through the developer options.

The sole effective method for removing SpyNote entails performing a factory reset on the device, which results in the deletion of all data from the phone.

Additionally, D3Lab also reported that some malicious entities are attempting to persuade Android users to install malware from the SpyNote family. They achieve this by deceiving individuals into downloading a fake IT-Alert app, purportedly related to Italy’s public alert system for emergencies and disasters, known as IT-Alert. These threat actors create a similarly named domain that warns users of an impending earthquake and encourages them to download an app for real-time updates on their area’s situation.

Check Also: Thousands of Android APKs Use Compression Methods to Evade Malware Analysis