Android backdoor spies on Russian business employees

Description

A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging apps and browsers, and keylogging. Distributed via messenger apps, it requests numerous system permissions and connects to C2 servers for commands. The backdoor can transmit SMS messages, contact lists, call logs, location data, and captured audio/video streams. It uses Accessibility Service to log keystrokes and intercept content from specific apps like Telegram and Chrome. The malware is believed to be used for targeted attacks rather than mass distribution.