How to protect yourself from Android malware that steals your personal data

You protect yourself from Android malware that steals your personal data by installing apps only from Google Play, not giving them accessibility rights unless they really need them, and keeping your phone up to date. Below, you’ll find the example of BlackRock, a trojan discovered in 2020, and what has changed since.

In July 2020, researchers at ThreatFabric discovered BlackRock, a piece of malware that could compromise many of the apps installed on a phone and could, by extension, steal users’ personal data. The most exposed were people who used unofficial (third-party) app stores. The details are in ThreatFabric’s report on BlackRock.

The malware wasn’t completely new: it was based on the code of the Xerxes trojan, from the LokiBot family. What set BlackRock apart from other malware apps was that it didn’t attack only banking apps.

BlackRock could intercept personal data from 337 apps, including Gmail, Netflix, Snapchat, eBay, Twitter, Facebook Messenger, PayPal and TikTok. When it was discovered, it hadn’t managed to get into Google Play, but researchers expected the attackers to find a way past Google’s checks.

How did the BlackRock malware work?

The malware opened fake windows over legitimate apps, so users could easily be fooled: before using the app, they were asked to enter their login details or their card details.

The virus was smart enough to grant itself full rights from the settings. When an infected app was installed, it opened a fake window imitating a Google services update, and most of the time users accepted without hesitation.

The settings in the Accessibility menu are designed for people with disabilities and automate certain actions, such as taps on the screen. The malicious app took over access to these settings and was thus able to grant itself administrator rights over the device.

This way, BlackRock could intercept text messages, hide notifications, lock the screen or pass on everything typed on the phone.

Unfortunately, the malicious app was built so it could disable antivirus apps and block users from accessing them: whenever a security app was launched, the malware sent the user back to the home screen.

What has changed since then?

Android banking trojans have kept evolving. Some, such as Anatsa (also known as TeaBot), have in recent years even made it into Google Play, hidden in seemingly useful apps, such as document readers, which download the malware only after an update. The basic method has stayed the same: abusing accessibility permissions and showing fake windows over banking apps.

Protections have improved too. Since Android 13 (2022), apps installed from outside the official stores can no longer get accessibility rights directly (the so-called restricted settings), and Google Play Protect also checks apps installed from other sources.

How can you protect yourself from Android malware?

Steps that can keep your Android phone from getting infected:

• install apps only from Google Play, and check the developer, the number of downloads and the reviews;
• pay attention to the permissions new apps ask for;
• don’t grant permissions in the Accessibility menu if the app doesn’t need them: a flashlight or a document reader doesn’t;
• keep your phone updated, and replace it when it no longer receives security updates;
• leave Google Play Protect turned on;
• for important accounts, use two-step verification through an app or a passkey, not via SMS, which malware can read.

A work phone has become essential for employees to do their jobs: it holds their email, the company’s apps and their authentication codes. In a company, phones are managed centrally (MDM), with rules that block apps from untrusted sources and allow data to be wiped remotely if a phone is lost.

See also how we protect ourselves from Ghimob, a trojan that targets banking apps on Android and popular types of malware.

RezolvIT is an IT outsourcing company experienced in successfully securing and protecting its clients’ infrastructure. Whether we’re talking about laptops, desktops, servers or mobile devices, the company adopts and proposes solutions to head off any security threats that may arise. See also IT security.