CybersecurityUpdated November 3

The malware loaded after setup, slipping past Google's checks

The timing helped the malware slip past Google's screening. Google says obfuscation played a role, and that malicious code was loaded only after a device's first boot. Once a compromised box was set up and online, a small stub app contacted its operator. The app had no malicious abilities of its own, but system-level permissions let it install malware modules remotely and disable Play Protect, which would otherwise have flagged silently installed packages. Google says it changed its review process to catch similar activity, but hasn't shared the details.

2 publishers2 reports

Coverage started November 2