Bitdefender researchers have identified a new powerful Android Spyware called Triout. It can secretly record phone calls, collect images, videos, SMS and GPS coordinates of victims and send this information to the attackers.
Triout has been active since May of this year and is distributed through a fake Android that was available on the Google Play Store in 2016.
Although the app has been removed from the Play Store, a repackaged version of it is still available from other sources and is signed by the authentic Google Debug Certificate.
The Spyware app is designed to turn Android devices into a powerful surveillance tool and sends the stolen data to servers controlled by attackers.
Researchers are unsure of the app's origin or how many times it has been installed on phones, but it was likely distributed through third-party app stores or app sharing forums.
Analysis of the malware suggests it originated in Russia, but was not necessarily created there. Multiple Israeli samples collected by the app were also found, suggesting a massive surveillance and espionage campaign.
Most impressively, however, Spyware is completely obfuscated, meaning that only opening the .apk will make the source code visible. This suggests that the software may be a work in progress, and perhaps its creators are testing additional features to make it compatible with more devices.
To avoid falling victim to Triout or similar malware, researchers urge users not to install apps other than those from the official store. They also advise users not to unnecessarily grant permissions that grant access to call logs, messages, and media files.
