- Apr 21, 2016
- 4,389
The malware, which was detected by Trustlook (via FossBytes), has the capabilities to modify the “/system/etc/install-recovery.sh” file in order to start at every boot, thus making sure that it can extract instant messaging data even if the device is restarted.
The first infected application is called Cloud Module and is spreading in China as package name com.android.boxa. It hasn’t yet reached the Google Play Store, and most likely the malware is supposed to target devices using non-store distribution tactics, such as email and downloads from third-p... (read more)
Read more: New Android Virus Extracts Your Facebook, Skype, Telegram Messages