Newly discovered Android malware takes advantage of five different known security flaws to gain "root" privileges on smartphones, giving itself greater system capabilities than normal phones

The malware, named AbstractEmu by the discoverers at information security firm Lookout, has been found in the Amazon App Store, Samsung Galaxy Store, as well as Aptoide, APKPure, and other "offload" Android It is hidden in utility, security, and privacy apps found in the app market

One of the apps, called Lite Launcher, was downloaded more than 10,000 times from the official Google Play Store until Google removed it after receiving notification from Lookout Despite containing malware, these Trojanized apps are well designed and function as advertised, so you probably won't notice anything wrong with them [Yesterday (October 28), Kristina Balaam and Paul Shunk of Lookout wrote in a blog post, "This is an important finding because over the past five years, malware with root functionality has become rare to be widely distributed"

Installing such a poisoned app installs spyware posing as a storage manager called "Setting Storage," which "gives access to contacts, call history, SMS messages, location, camera, and microphone" in a three-step The infection process is initiated

Because the spyware has root privileges, it resets device passwords, locks you out of your own device, draws on top of other windows, installs more apps, captures screenshots, displays notifications, and records screen activity, disable Google Play protection, and more

The ultimate purpose of this malware campaign is unknown as the command and control server was taken offline before Lookout's researchers captured the final payload

However, the malware's capabilities go far beyond what is required to steal sensitive information such as passwords and credit card numbers from Android phones or to register Android users for premium SMS scams, as most malware does these days beyond

Of the 19 known apps distributed in this malware campaign, seven have rooting capabilities They are:

If any of the apps match these names, we recommend checking to see if they are indeed the same app Many apps share a name, but the package name (the text string beginning with "com" above) is unique

Using a desktop browser, go to the app store where you got the app and search for it If the app is not in the app store, remove it from the device

If the app you downloaded is still there, see if the icon on the list page for that app matches the one on your phone If so, check the URL, or web address, of the listing page; somewhere in the URL should be an Android package name If it matches the package name above, remove the app

This last step does not work with the Amazon App Store; the Amazon App Store does not seem to list the Android package name of the app anywhere Use your own judgment

You should also keep your Android phone as updated as possible The flaws used by this malware have all been fixed as of the official Android security update in March 2020 If your Android phone has not received a security update since then, it may be time to consider purchasing a new phone

As always, to stay one step ahead of the scammers, you want to install one of the best Android antivirus apps and not install apps from the offload store