New Android Malware FireScam Targets Users

Researchers have identified a sophisticated Android malware known as FireScam, which masquerades as a Telegram Premium app and is distributed through a phishing site on GitHub that mimics the RuStore app store popular in Russia. FireScam employs advanced obfuscation techniques to evade detection and has been designed to exfiltrate sensitive data, including notifications and login credentials, by monitoring device activities. Once installed, the malware uses a dropper mechanism to acquire extensive permissions, establishing communication with a Firebase Realtime Database to upload stolen data and maintain control over compromised devices. The malware's capabilities include monitoring clipboard activity, SMS, and telephony services, posing significant risks to both individuals and organizations worldwide. Experts warn that users should only download apps from official sources to mitigate the risk of falling prey to such phishing attacks. The emergence of FireScam reflects a broader trend of sophisticated cyber threats targeting Android devices, particularly in regions with alternative app marketplaces.