Accessibility Service is an auxiliary function provided by the Android system to help people with physical disabilities use mobile apps. It runs in the background in the way of Accessibility Service. In the apps list of the system settings, it usually disguises the package name as something like “” to make users think it is a system service of Google. The dropped payload will not display icons and it does not operate directly on the screen of the user’s device. Payload disguised as a certificate file (crt extension) Stealing social and gaming accounts The payload package will be in the assets folder, and it will disguise the file name as “*. Second, it will install a n additional payload with package name “ .policy_sidecar_aps ” using the “pm install” command. Get a Google account from the Android system account database. F irst, it will steal accounts by accessing the system account database and application database. When it gains root permission, it will start two malicious actions. Error message when root access is not provided If the user denies superuser request the malware will s ay that the application may not work : Figure 3. This malware will ask the user to allow superuser permission after running: Figure 2. Initial malware requesting root access. Re-packaged hacking tool distributed in Telegram Main dropper behavior Fortunately, this malware has not been found on Google Play. How can you be affected by this malware?Īfter investigation, it was found that this malware was spread in the channels related to PUBG game on the Telegram platform. ESP Hacks are not a single hack, but a whole category of hacks that function similarly and are often used together to make them more effective. It is like a permanent tuned-up KDR/HP Vision. What is an ESP hack?ĮSP Hacks, (short for Extra-Sensory Perception) are a type of hack that displays player information such as HP (Health Points), Name, Rank, Gun etc. PUBG game users are the main targets of this Android malware in all regions around the world but most infections are reported from the United States, India, and Saudi Arabia. Basically, cyber criminals added their own malicious code based on this DesiEsp open-source tool and published it on Telegram. This malware hides in a game assistant tool called “DesiEsp” which is an assistant tool for PUBG game available on GitHub. McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter, Telegram and PUBG game accounts.

Fifa hack tool android