Spy Dealer: Android Trojan Spying on More Than 40 Apps
Summary: Palo Alto Networks researchers discovered an Android trojan named SpyDealer that exfiltrates private data from more than 40 apps and steals messages from communication apps by abusing the Android accessibility service. SpyDealer uses root exploits taken from the commercial rooting app Baidu Easy Root, and researchers captured 1,046 samples across three versions (1.9.1, 1.9.2, 1.9.3), with the oldest dating to October 2015 and the most recent created in May 2017.
What's compelling: SpyDealer's TCP server on port 39568 has no authentication, so anyone who knows a compromised device's IP address can control it, and its powermanager component reinstalls the APK as a system app after uninstallation.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026