New Android Spyware That Asks Password From Users to Uninstall

A new type of Android spyware that requires a password for uninstallation has been identified, making it increasingly difficult for victims to remove the malicious software from their devices.

A stealthy phone monitoring app that effectively blocks device owners from removing it by requiring a password during the uninstallation process. 

The password is set by whoever installed the spyware, creating a significant obstacle for victims trying to regain control of their devices.

According to the report, “this sneaky Android spyware needs a password to uninstall,” highlighting a concerning trend in surveillance technology. 

The malware exploits Android’s built-in “overlay” feature, which allows apps to display content on top of other applications.

The spyware app uses this overlay access to forcibly display a password prompt whenever the user tries to uninstall or deactivate the app through Android’s settings. 

TechCrunch observed that the overlay technique is part of a growing concern in Android security as malicious developers find new ways to abuse legitimate system features.

How the Malware Operates

The spyware is typically installed by someone with physical access to the victim’s phone and knowledge of their passcode. Once activated, the app grants itself device administrator privileges and hides its icon from the home screen.

When a victim attempts to uninstall the app through normal means, the overlay feature triggers a password prompt that prevents removal. 

Without the correct password, removal is blocked, and the app continues monitoring the victim’s messages, photos, location, and other sensitive information.

Researchers noted that “Consumer-grade spyware apps aren’t only intended to stay stealthy; some of these apps are also making it increasingly difficult to remove them.”

Bypass Android Spyware

Fortunately, researchers have discovered an effective removal method that bypasses password protection. By rebooting the Android device into “safe mode,” users can temporarily prevent third-party apps from loading.

“Safe mode only allows the device’s pre-installed apps to run, allowing users to remove malicious applications without triggering their protective mechanisms,” explains a mobile security expert from McAfee.

The removal process requires several steps:

• Boot the device into safe mode by holding the power button and then long-pressing the “Power off” option
• Once in safe mode, navigate to Settings > Security > Device admin apps
• Deactivate the suspicious app’s administrator privileges
• Return to Settings > Apps and uninstall the application

“This consumer-grade spyware is part of a growing ecosystem of phone monitoring offerings, which promote and sell their apps under the guise of allowing parents to monitor their children’s phone activities or companies to track their employees,” TechCrunch added.

Security experts recommend several preventive measures, including keeping Google Play Protect enabled, regularly checking for unauthorized device administrator apps, and being cautious about physical access to your device.

For those concerned about potential infection, experts recommend using reputable antivirus solutions like Malwarebytes or Norton, which can scan for known stalkerware applications.

As this threat continues to evolve, users should remain vigilant about unusual device behavior, such as the phone running warmer or slower than usual or experiencing increased data usage without explanation.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free