Android users are facing a new malware threat: FireScam. A technical analysis by cyber threat experts has uncovered malware called FireScam. It operates on devices using advanced obfuscation techniques to steal sensitive data and evade detection. FireScam harms users by ostensibly presenting itself as a fake Telegram Premium app and spreads via a spoof of RuStore, an app store that is particularly popular in Russia. However, experts warn that this threat is not limited to a specific region, but can spread in different countries and through various distribution routes.

New malware threat emerges on the Android platform

FireScam works through a two-stage attack process. First, the software infects devices with a dropper. Then the data theft begins. The malware tries to hide and evade detection by utilizing legitimate services such as Firebase. However, it does more than just steal data, it establishes a permanent control over the device and can completely take over the user’s device.

The software monitors screen state changes, e-commerce activity, clipboard movements and other user interactions on the device. It also targets users by collecting notifications from many different apps, including system apps. It exfiltrates this information using a real-time database on Firebase. Users can lose a lot of information without realizing that their messages and app data are being secretly leaked.

Experts point out that such malware poses a serious threat not only to individuals but also to organizations. They emphasize that users can only be protected by downloading apps from trusted stores and avoiding fake app stores. The FireScam example demonstrates once again how sophisticated and dangerous modern malware has become.