required permissions

"Mandrake" is a type of Android spyware identified by Bitdefender in 2020, which had been undetected for four years. A new variant was detected by Kaspersky two years later. The spyware has been downloaded 32,000 times, primarily through the AirFS app, which masqueraded as a Wi-Fi file sharing tool. The spyware uses native libraries to hide its payload and communicates with a command-and-control server via a library named "libopencv_java3.so." After installation, it deceives users with fake Play Store notifications to download additional malicious APKs. The spyware can detect the presence of the Frida toolkit, used by security experts, and ensures the target device has the necessary permissions. AirFS, which had 30,305 downloads, has been removed from the Google Play Store, along with four other apps distributing Mandrake. Google is working to improve its Play Protect feature to combat rogue apps, but malicious behavior remains a challenge in the diverse Android ecosystem. Cybercriminals also mimic Google with credible push notifications.